Is CVE-2026-14452 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14452 being exploited in the wild.

How severe is CVE-2026-14452?

Informational severity, published 16 October 2026.

Which products and versions are affected?

Checkmk 2.5.0 before 2.5.0p15, 2.4.0 before 2.4.0p38, 2.3.0 before 2.3.0p51, 2.2.0 (EOL).

Is there a fix for CVE-2026-14452?

Yes: fixed in Checkmk 3.0.0b1, 2.5.0p15, 2.4.0p38, 2.3.0p51. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14452 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-14452?

Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14452: Checkmk Setup search parameter open redirect and XSS

CVE-2026-14452 · Severity: info · Published 2026-10-16

Checkmk is a monitoring and alerting platform used to track infrastructure and applications. A flaw in the Setup search feature allows an attacker to craft a malicious URL that, when clicked by an authenticated administrator, can execute arbitrary scripts in their browser session or redirect them to a phishing site. The attack requires the victim to click a link and interact with the search interface.

Technologies: Checkmk. Vendors: Checkmk.

Quick answers

Is CVE-2026-14452 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14452 being exploited in the wild.
How severe is CVE-2026-14452?: Informational severity, published 16 October 2026.
Which products and versions are affected?: Checkmk 2.5.0 before 2.5.0p15, 2.4.0 before 2.4.0p38, 2.3.0 before 2.3.0p51, 2.2.0 (EOL).
Is there a fix for CVE-2026-14452?: Yes: fixed in Checkmk 3.0.0b1, 2.5.0p15, 2.4.0p38, 2.3.0p51. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14452 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-14452?: Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Checkmk 3.0.0b1, 2.5.0p15, 2.4.0p38, 2.3.0p51

Technical details

The Setup in-page search feature (PageMenuSearch) fails to validate the reset_url query parameter, allowing both javascript: scheme injection for XSS and absolute URLs for open redirect attacks. Exploitation requires network access and an authenticated user with Setup access to click a crafted link and submit an empty search or click the Reset button. An attacker can steal session credentials, modify monitoring configuration, or redirect the user to a malicious site.

Affected products

Checkmk Checkmk 2.5.0 before 2.5.0p15, 2.4.0 before 2.4.0p38, 2.3.0 before 2.3.0p51, 2.2.0 (EOL)

Timeline

2026-10-16: disclosed: CVE-2026-14452 published
2026-09-02: patched: Fix released: restrict reset_url to same-origin relative URLs

References

https://checkmk.com/werk/22314

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.