Executive brief
Checkmk is an IT monitoring platform used to track the health of servers and networks. A security flaw in distributed setups allowed the secret key used for user sessions to be shared with remote monitoring sites. This could allow a malicious administrator of a remote site to impersonate users on the central management server, potentially gaining full control over the monitoring infrastructure.
Technical details
A vulnerability in Checkmk's configuration synchronization mechanism caused the session signing secret to be copied to remote sites. Additionally, a legacy user-sync automation synchronized user sessions between sites. An attacker with administrative access to a remote site could use the signing secret and a valid session ID to forge session cookies, enabling session hijacking on the central site. The issue is classified as CWE-522 (Insufficiently Protected Credentials) and affects distributed setups where config sync is enabled. Patches are available in versions 2.4.0p23 and 2.3.0p45.
Affected products
- Checkmk Checkmk < 2.4.0p23, < 2.3.0p45, 2.2.0
Timeline
- 2026-03-03: patched: Vendor released fix in versions 2.4.0p23 and 2.3.0p45
- 2026-03-24: disclosed: Initial CVE publication