Executive brief
Checkmk, a popular IT infrastructure monitoring solution, contains a vulnerability in its quicksearch feature. An authenticated user can bypass security filters to execute unauthorized commands within the monitoring core. This could allow a malicious user to access sensitive monitoring data or disrupt the availability of the monitoring service.
Technical details
A Livestatus injection vulnerability exists in the monitoring quicksearch component of Checkmk. The root cause is insufficient input sanitization within search filter plugins, specifically failing to neutralize delimiters before interpolating user-supplied values into Livestatus filter headers (CWE-140). An authenticated attacker with network access to the web interface can exploit this by submitting crafted search queries. Successful exploitation allows the attacker to inject arbitrary Livestatus commands, potentially leading to unauthorized data retrieval or modification of the monitoring state. The issue is resolved in version 2.5.0b4 and later.
Affected products
- Checkmk GmbH Checkmk < 2.5.0b4
Timeline
- 2026-03-20: patched: Vendor fix released in version 2.5.0b4
- 2026-04-10: disclosed: Initial CVE publication
- 2026-04-20: advisory: NVD analysis and enrichment completed