# CVE-2026-20915: Checkmk stored XSS in Pending Changes sidebar

Source: https://junglewise.ai/threats/cve-2026-20915-checkmk-stored-xss-in-pending-changes-sidebar  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-20915 · Severity: medium · CVSS 5.4 · Published 2026-03-31

Checkmk, a popular IT infrastructure monitoring platform, contains a security flaw that allows certain authorized users to inject malicious scripts into the management interface. If an administrator or another user views the 'Pending Changes' sidebar, these scripts could execute in their browser, potentially leading to unauthorized actions or data theft. This issue affects organizations using the 2.5.0 beta version of the software.

Technologies: [Checkmk](https://junglewise.ai/threats/technologies/checkmk). Vendors: [Checkmk](https://junglewise.ai/threats/vendors/checkmk).

## Quick answers

**Is CVE-2026-20915 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20915 being exploited in the wild.

**How severe is CVE-2026-20915?** Medium severity, with a CVSS score of 5.4, published 31 March 2026.

**Which products and versions are affected?** Checkmk GmbH Checkmk 2.5.0 (beta) before 2.5.0b2.

**Is there a fix for CVE-2026-20915?** A patch was published on 2026-03-23: Vendor released fix in version 2.5.0b2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20915 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20915?** Check whether you run Checkmk. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Checkmk version 2.5.0 (beta) before 2.5.0b2. The 'Pending Changes' sidebar fails to properly sanitize change attributes before rendering them in the web interface. An authenticated attacker with permissions to create pending changes can inject arbitrary JavaScript into these attributes. When other users (such as administrators) view the sidebar, the malicious payload executes in their security context. This can lead to session hijacking or unauthorized configuration changes. The issue is resolved in version 2.5.0b2.

## Affected products

- Checkmk GmbH Checkmk 2.5.0 (beta) before 2.5.0b2

## Timeline

- 2026-03-23: patched: Vendor released fix in version 2.5.0b2
- 2026-03-31: disclosed: CVE published and vendor advisory released

## References

- [https://checkmk.com/werk/19526](https://checkmk.com/werk/19526)

## Related threats

- [Checkmk Kubernetes special agent argument injection](https://junglewise.ai/threats/cve-2026-121374-argument-injection-in-the-kubernetes-special-agent-in-checkmk-2)
- [Checkmk Robotmk path traversal in HTML log](https://junglewise.ai/threats/cve-2026-120495-path-traversal-in-the-synthetic-monitoring-robotmk-test-service)
- [Checkmk path traversal in remote site label synchronization](https://junglewise.ai/threats/cve-2026-118965-path-traversal-in-the-discovered-host-label-synchronization-in)
- [Checkmk Windows agent privilege escalation via unprotected data directory](https://junglewise.ai/threats/cve-2026-111573-incorrect-permissions-on-the-checkmk-windows-agent-s-data)
- [Checkmk Jolokia agent password exposure in process list](https://junglewise.ai/threats/cve-2026-103682-invocation-of-the-jolokia-special-agent-with-the-login-password)