Quick answers
- Is CVE-2026-20915 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-20915 being exploited in the wild.
- How severe is CVE-2026-20915?
- Medium severity, with a CVSS score of 5.4, published 31 March 2026.
- Which products and versions are affected?
- Checkmk GmbH Checkmk 2.5.0 (beta) before 2.5.0b2.
- Is there a fix for CVE-2026-20915?
- A patch was published on 2026-03-23: Vendor released fix in version 2.5.0b2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-20915 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-20915?
- Check whether you run Checkmk. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Checkmk version 2.5.0 (beta) before 2.5.0b2. The 'Pending Changes' sidebar fails to properly sanitize change attributes before rendering them in the web interface. An authenticated attacker with permissions to create pending changes can inject arbitrary JavaScript into these attributes. When other users (such as administrators) view the sidebar, the malicious payload executes in their security context. This can lead to session hijacking or unauthorized configuration changes. The issue is resolved in version 2.5.0b2.
Affected products
- Checkmk GmbH Checkmk 2.5.0 (beta) before 2.5.0b2
Timeline
- 2026-03-23: patched: Vendor released fix in version 2.5.0b2
- 2026-03-31: disclosed: CVE published and vendor advisory released