# CVE-2025-64998: Checkmk session hijacking via session signing secret exposure

Source: https://junglewise.ai/threats/cve-2025-64998-checkmk-session-hijacking-via-session-signing-secret-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-24. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2025-64998 · Severity: high · CVSS 7.2 · Published 2026-03-24

Checkmk is an IT monitoring platform used to track the health of servers and networks. A security flaw in distributed setups allowed the secret key used for user sessions to be shared with remote monitoring sites. This could allow a malicious administrator of a remote site to impersonate users on the central management server, potentially gaining full control over the monitoring infrastructure.

Technologies: [Checkmk](https://junglewise.ai/threats/technologies/checkmk). Vendors: [Checkmk](https://junglewise.ai/threats/vendors/checkmk).

## Quick answers

**Is CVE-2025-64998 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64998 being exploited in the wild.

**How severe is CVE-2025-64998?** High severity, with a CVSS score of 7.2, published 24 March 2026.

**Which products and versions are affected?** Checkmk < 2.4.0p23, < 2.3.0p45, 2.2.0.

**Is there a fix for CVE-2025-64998?** A patch was published on 2026-03-03: Vendor released fix in versions 2.4.0p23 and 2.3.0p45 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-64998 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-64998?** Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Checkmk's configuration synchronization mechanism caused the session signing secret to be copied to remote sites. Additionally, a legacy user-sync automation synchronized user sessions between sites. An attacker with administrative access to a remote site could use the signing secret and a valid session ID to forge session cookies, enabling session hijacking on the central site. The issue is classified as CWE-522 (Insufficiently Protected Credentials) and affects distributed setups where config sync is enabled. Patches are available in versions 2.4.0p23 and 2.3.0p45.

## Affected products

- Checkmk Checkmk < 2.4.0p23, < 2.3.0p45, 2.2.0

## Timeline

- 2026-03-03: patched: Vendor released fix in versions 2.4.0p23 and 2.3.0p45
- 2026-03-24: disclosed: Initial CVE publication

## References

- [https://checkmk.com/werk/18954](https://checkmk.com/werk/18954)

## Related threats

- [Checkmk Kubernetes special agent argument injection](https://junglewise.ai/threats/cve-2026-121374-argument-injection-in-the-kubernetes-special-agent-in-checkmk-2)
- [Checkmk Robotmk path traversal in HTML log](https://junglewise.ai/threats/cve-2026-120495-path-traversal-in-the-synthetic-monitoring-robotmk-test-service)
- [Checkmk path traversal in remote site label synchronization](https://junglewise.ai/threats/cve-2026-118965-path-traversal-in-the-discovered-host-label-synchronization-in)
- [Checkmk Windows agent privilege escalation via unprotected data directory](https://junglewise.ai/threats/cve-2026-111573-incorrect-permissions-on-the-checkmk-windows-agent-s-data)
- [Checkmk Jolokia agent password exposure in process list](https://junglewise.ai/threats/cve-2026-103682-invocation-of-the-jolokia-special-agent-with-the-login-password)