Threat database

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.

Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.

CVE-2026-105331 is a local privilege escalation vulnerability in Checkmk versions 2.5.0 up to but not including 2.5.0p10. It arises from an untrusted search path issue in the 'mk-oracle' agent plugin that references the Oracle Instant Client. A user with access to modify the Oracle Instant Client used by this plugin can escalate privileges if the plugin is enabled on the agent.

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services outside their contact groups and occupying web server and Livestatus workers for an attacker-controlled duration.

CVE-2026-92882 is a vulnerability in Checkmk versions prior to certain patch levels that allows an authenticated user with permission to view host configurations to retrieve sensitive credentials such as SNMP community strings, SNMPv3 authentication and privacy passphrases, and IPMI passwords in clear text via the REST API. These credentials are not displayed in the setup GUI but are exposed in GET responses from the host and folder configuration endpoints.

Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an arbitrary size.

Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.

CVE-2026-17548 is a medium severity vulnerability in Checkmk versions prior to certain patch releases that allows an authenticated user with knowledge of a background job ID to view the status and results of that job due to missing authorization checks.

CVE-2026-15576 is a medium severity vulnerability in Checkmk versions 2.5.0 through 2.5.0p9. It involves improper authentication in the agent receiver component, allowing an unauthenticated remote attacker to bypass mutual TLS client certificate verification on relay endpoints by using a fixed placeholder identity in the request URL. This issue affects only the Cloud, Ultimate, and Ultimate MT editions of Checkmk, as other editions do not expose relay endpoints. The impact is limited to integrity and availability.

CVE-2026-7485 is an incorrect authorization vulnerability in Checkmk versions prior to certain patch levels. It affects frozen BI aggregations and allows an authenticated user with restricted host and service visibility to discover the names and existence of hosts and services they should not be authorized to see. The vulnerability has a low severity score and does not allow further privilege escalation or data modification.

CVE-2026-15227 is a medium severity vulnerability in Checkmk that allows an authenticated user without the 'Edit foreign Reports' permission to modify reports owned by other users. It affects Checkmk versions prior to 2.5.0p10, 2.4.0p35, and 2.3.0p49, as well as version 2.2.0 which is end-of-life. This is due to missing authorization checks in the affected versions.

Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules

Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. Without an explicit database configuration, the mk_sap_hana agent plugin derives instance identifiers from the process list and uses them to build a command executed with elevated privileges (requires the plugin to run as root with RUNAS=agent).

Stored cross-site scripting in the service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can configure active or custom checks to inject malicious HTML or JavaScript into check output that executes in the browser of an admin or a user with host read permissions when they run the check on the service discovery page.

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another user interacts with the crafted link.

Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can change global settings to store malicious HTML or JavaScript in changelog messages that executes in other users' browsers when they view the Activate Changes page or Audit log.

Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing an attacker who knows a valid public dashboard share token to read the issuer's personal messages by sending requests to the underlying endpoint, even without a User Messages widget present.

Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions to store a URL with a dangerous URI scheme such as javascript: that executes scripts in other users' browsers when they view the dashboard.

Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows service whose name matches 'MySQL' or 'MariaDB' (or with write access to a binary referenced by such a service) to execute arbitrary code in the context of the Checkmk agent service, which typically runs as SYSTEM.