Executive brief
Checkmk is a popular infrastructure monitoring platform. A relay and push agent that share the same UUID can reuse each other's mTLS certificates to authenticate to agent receiver endpoints, bypassing authentication controls that should isolate relay and agent access. This allows an attacker with knowledge of a matching UUID to impersonate either a relay or agent and access monitoring endpoints.
Technical details
The vulnerability is an improper certificate validation flaw in Checkmk's agent receiver endpoints (prior to version 2.5.0p10). Agent receiver endpoints fail to verify that mTLS certificates were issued by their own root certificate authority, allowing a relay and a push agent with identical UUIDs to reuse each other's certificates for authentication. An attacker must have access to both a relay and an agent registered with matching UUIDs and knowledge of their mTLS certificates to exploit this. The attack vector is network-based and requires prior authentication context. The fix, released in Checkmk 2.5.0p10 and 3.0.0b1, adds issuer verification so each endpoint only trusts certificates from its own root CA.
Affected products
- Checkmk Checkmk <2.5.0p10
Timeline
- 2026-09-04: disclosed
- 2026-07-17: patched: Fixed in Checkmk 2.5.0p10 and 3.0.0b1