Quick answers
- Is CVE-2026-121374 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121374 being exploited in the wild.
- How severe is CVE-2026-121374?
- Informational severity, published 11 November 2026.
- Which products and versions are affected?
- Checkmk 2.5.0 before 2.5.0p19, 2.4.0 before 2.4.0p40, 2.3.0 (EOL).
- Is there a fix for CVE-2026-121374?
- Yes: fixed in Checkmk 2.5.0p19, 2.4.0p40, 3.0.0b1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-121374 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-121374?
- Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Checkmk 2.5.0p19, 2.4.0p40, 3.0.0b1
Technical details
The Kubernetes special agent in Checkmk fails to properly separate node role parameters from command-line options, allowing argument injection. An attacker with rule-editing permissions can craft malicious node roles (specifically using the --profile flag) to write files to arbitrary locations writable by the site user, including executable Python scripts. The vulnerability requires authentication and folder-level rule-editing permissions but does not require the target site to actually monitor Kubernetes.
Affected products
- Checkmk Checkmk 2.5.0 before 2.5.0p19, 2.4.0 before 2.4.0p40, 2.3.0 (EOL)
Timeline
- 2026-11-11: disclosed: CVE-2026-121374 published