# CVE-2026-14452: Checkmk Setup search parameter open redirect and XSS

Source: https://junglewise.ai/threats/cve-2026-14452-improper-validation-of-the-reset-url-parameter-of-the-setup-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-14452 · Severity: info · Published 2026-10-16

Checkmk is a monitoring and alerting platform used to track infrastructure and applications. A flaw in the Setup search feature allows an attacker to craft a malicious URL that, when clicked by an authenticated administrator, can execute arbitrary scripts in their browser session or redirect them to a phishing site. The attack requires the victim to click a link and interact with the search interface.

Technologies: [Checkmk](https://junglewise.ai/threats/technologies/checkmk). Vendors: [Checkmk](https://junglewise.ai/threats/vendors/checkmk).

## Quick answers

**Is CVE-2026-14452 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14452 being exploited in the wild.

**How severe is CVE-2026-14452?** Informational severity, published 16 October 2026.

**Which products and versions are affected?** Checkmk 2.5.0 before 2.5.0p15, 2.4.0 before 2.4.0p38, 2.3.0 before 2.3.0p51, 2.2.0 (EOL).

**Is there a fix for CVE-2026-14452?** Yes: fixed in Checkmk 3.0.0b1, 2.5.0p15, 2.4.0p38, 2.3.0p51. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14452 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-14452?** Check whether you run Checkmk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Checkmk 3.0.0b1, 2.5.0p15, 2.4.0p38, 2.3.0p51

## Technical details

The Setup in-page search feature (PageMenuSearch) fails to validate the reset_url query parameter, allowing both javascript: scheme injection for XSS and absolute URLs for open redirect attacks. Exploitation requires network access and an authenticated user with Setup access to click a crafted link and submit an empty search or click the Reset button. An attacker can steal session credentials, modify monitoring configuration, or redirect the user to a malicious site.

## Affected products

- Checkmk Checkmk 2.5.0 before 2.5.0p15, 2.4.0 before 2.4.0p38, 2.3.0 before 2.3.0p51, 2.2.0 (EOL)

## Timeline

- 2026-10-16: disclosed: CVE-2026-14452 published
- 2026-09-02: patched: Fix released: restrict reset_url to same-origin relative URLs

## References

- [https://checkmk.com/werk/22314](https://checkmk.com/werk/22314)

## Related threats

- [Checkmk Kubernetes special agent argument injection](https://junglewise.ai/threats/cve-2026-121374-argument-injection-in-the-kubernetes-special-agent-in-checkmk-2)
- [Checkmk Robotmk path traversal in HTML log](https://junglewise.ai/threats/cve-2026-120495-path-traversal-in-the-synthetic-monitoring-robotmk-test-service)
- [Checkmk path traversal in remote site label synchronization](https://junglewise.ai/threats/cve-2026-118965-path-traversal-in-the-discovered-host-label-synchronization-in)
- [Checkmk Windows agent privilege escalation via unprotected data directory](https://junglewise.ai/threats/cve-2026-111573-incorrect-permissions-on-the-checkmk-windows-agent-s-data)
- [Checkmk Jolokia agent password exposure in process list](https://junglewise.ai/threats/cve-2026-103682-invocation-of-the-jolokia-special-agent-with-the-login-password)