Threat Intelligence Database

Missing authorization in Checkmk <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results.

Checkmk versions prior to 2.5.0p10 contain an improper authentication vulnerability in the agent receiver component. This flaw allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification for relay endpoints by using a fixed placeholder identity in the request URL. The vulnerability affects only the Cloud, Ultimate, and Ultimate MT editions, as other editions do not expose relay endpoints. The impact is limited to integrity and availability. No known exploits are reported in the wild, and no official patch information is provided.

Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only the Cloud, Ultimate and Ultimate MT editions are affected, as other editions do not expose relay endpoints.

Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see.

CVE-2026-15227 is a medium severity vulnerability in Checkmk that allows an authenticated user without the 'Edit foreign Reports' permission to modify reports owned by other users. It affects Checkmk versions prior to 2.5.0p10, 2.4.0p35, and 2.3.0p49, as well as version 2.2.0 which is end-of-life. This is due to missing authorization checks in the affected versions.