CVE-2026-15576: Checkmk agent receiver mTLS authentication bypass

CVE-2026-15576 · Severity: info · CVSS 6.9 · Published 2026-08-21

Checkmk's agent receiver component is used to securely receive monitoring data from remote agents and relays. An attacker can bypass mutual TLS certificate verification by supplying a fixed placeholder value in the request URL, allowing unauthenticated access to relay endpoints without presenting a valid client certificate. This affects only Cloud, Ultimate, and Ultimate MT editions.

Vendors: Checkmk.

Quick answers

Is CVE-2026-15576 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-15576 being exploited in the wild.
How severe is CVE-2026-15576?
Informational severity, with a CVSS score of 6.9, published 21 August 2026.
Which products and versions are affected?
Checkmk Cloud <2.5.0p10; Checkmk Ultimate <2.5.0p10; Checkmk Ultimate MT <2.5.0p10.
Is there a fix for CVE-2026-15576?
A patch was published on 2026-07-16: Fixed in Checkmk 2.5.0p10 and 3.0.0b1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15576 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-15576?
Check whether you run Checkmk Cloud, Checkmk Ultimate or Checkmk Ultimate MT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper authentication issue in Checkmk's agent receiver where mTLS-protected endpoints accepted requests without a valid client certificate. When no certificate was provided, the system injected a fixed placeholder identity that could be reused by an attacker in the request URL to bypass mutual TLS verification. The attacker must have network access to the agent receiver endpoints and supply the known placeholder value as the identity parameter. This affects relay endpoints specifically, where an attacker could impersonate a relay without authentication. The fix (released in version 2.5.0p10 and 3.0.0b1) now rejects any mTLS-protected endpoint request that lacks a verified client certificate and blocks client-supplied identity headers.

Affected products

  • Checkmk Checkmk Cloud <2.5.0p10
  • Checkmk Checkmk Ultimate <2.5.0p10
  • Checkmk Checkmk Ultimate MT <2.5.0p10

Timeline

  • 2026-08-21: disclosed: Public disclosure via NVD
  • 2026-07-16: patched: Fixed in Checkmk 2.5.0p10 and 3.0.0b1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.