# CVE-2026-33456: Checkmk Livestatus injection in notification test mode

Source: https://junglewise.ai/threats/cve-2026-33456-checkmk-livestatus-injection-in-notification-test-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-10. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-33456 · Severity: high · CVSS 7.6 · Published 2026-04-10

Checkmk is an IT infrastructure monitoring solution used to track the health of servers and networks. A security flaw in its notification testing feature allows authorized users to bypass intended restrictions and execute unauthorized commands within the monitoring database. This could allow a user to view sensitive monitoring data or disrupt the availability of the monitoring service.

## Quick answers

**Is CVE-2026-33456 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33456 being exploited in the wild.

**How severe is CVE-2026-33456?** High severity, with a CVSS score of 7.6, published 10 April 2026.

**Which products and versions are affected?** Checkmk Checkmk < 2.5.0b4, < 2.4.0p26.

**Is there a fix for CVE-2026-33456?** A patch was published on 2026-03-23: Vendor released fix in versions 2.5.0b4 and 2.4.0p26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33456 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-33456?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Livestatus injection vulnerability exists in Checkmk's notification test mode due to improper neutralization of delimiters (CWE-140). The application fails to properly sanitize user-supplied service description values before interpolating them into Livestatus queries. An authenticated attacker with access to the notification test page can provide a crafted service description to inject and execute arbitrary Livestatus commands. This can lead to unauthorized data retrieval or service disruption. The issue is resolved in versions 2.5.0b4 and 2.4.0p26.

## Affected products

- Checkmk Checkmk < 2.5.0b4, < 2.4.0p26

## Timeline

- 2026-03-23: patched: Vendor released fix in versions 2.5.0b4 and 2.4.0p26
- 2026-04-10: disclosed: Initial CVE publication

## References

- [https://checkmk.com/werk/17989](https://checkmk.com/werk/17989)