Is CVE-2026-33455 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33455 being exploited in the wild.

How severe is CVE-2026-33455?

Medium severity, with a CVSS score of 6.3, published 10 April 2026.

Which products and versions are affected?

Checkmk GmbH Checkmk < 2.5.0b4.

Is there a fix for CVE-2026-33455?

A patch was published on 2026-03-20: Vendor fix released in version 2.5.0b4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33455 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33455?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33455: Checkmk Livestatus injection in monitoring quicksearch

Q: Is there a fix for CVE-2026-33455?

A patch was published on 2026-03-20: Vendor fix released in version 2.5.0b4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33455 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-33455?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33455 · Severity: medium · CVSS 6.3 · Published 2026-04-10

Checkmk, a popular IT infrastructure monitoring solution, contains a vulnerability in its quicksearch feature. An authenticated user can bypass security filters to execute unauthorized commands within the monitoring core. This could allow a malicious user to access sensitive monitoring data or disrupt the availability of the monitoring service.

Quick answers

Is CVE-2026-33455 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33455 being exploited in the wild.
How severe is CVE-2026-33455?: Medium severity, with a CVSS score of 6.3, published 10 April 2026.
Which products and versions are affected?: Checkmk GmbH Checkmk < 2.5.0b4.
Is there a fix for CVE-2026-33455?: A patch was published on 2026-03-20: Vendor fix released in version 2.5.0b4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33455 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33455?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Livestatus injection vulnerability exists in the monitoring quicksearch component of Checkmk. The root cause is insufficient input sanitization within search filter plugins, specifically failing to neutralize delimiters before interpolating user-supplied values into Livestatus filter headers (CWE-140). An authenticated attacker with network access to the web interface can exploit this by submitting crafted search queries. Successful exploitation allows the attacker to inject arbitrary Livestatus commands, potentially leading to unauthorized data retrieval or modification of the monitoring state. The issue is resolved in version 2.5.0b4 and later.

Affected products

Checkmk GmbH Checkmk < 2.5.0b4

Timeline

2026-03-20: patched: Vendor fix released in version 2.5.0b4
2026-04-10: disclosed: Initial CVE publication
2026-04-20: advisory: NVD analysis and enrichment completed

References

https://checkmk.com/werk/17988

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.