# CVE-2026-7186: Checkmk stored XSS in URL dashboard widget

Source: https://junglewise.ai/threats/cve-2026-7186-checkmk-stored-xss-in-url-dashboard-widget  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-7186 · Severity: info · CVSS 8.5 · Published 2026-06-08

Checkmk is an IT infrastructure monitoring platform used to track the health of servers and networks. A security flaw in its dashboard system allows a user with dashboard editing rights to embed malicious scripts into shared views. If another user views the compromised dashboard, the script could execute in their browser, potentially allowing an attacker to steal session information or perform actions on the victim's behalf.

## Quick answers

**Is CVE-2026-7186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7186 being exploited in the wild.

**How severe is CVE-2026-7186?** Informational severity, with a CVSS score of 8.5, published 8 June 2026.

**Which products and versions are affected?** Checkmk GmbH Checkmk < 2.5.0p5, < 2.4.0p31, < 2.3.0p48, all 2.2.0 versions.

**Is there a fix for CVE-2026-7186?** A patch was published on 2026-04-29: Fix released in multiple versions via Werk #17991 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7186 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-7186?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the URL dashboard widget of Checkmk. The component failed to properly validate URI schemes, allowing the use of 'javascript:' or other dangerous schemes. An attacker with dashboard editing permissions can save a malicious URL that executes arbitrary JavaScript when the dashboard is viewed by other users. This requires the victim to open the shared dashboard via the 'Monitor' or 'Customize' menus. The issue is resolved in versions 2.5.0p5, 2.4.0p31, and 2.3.0p48 by restricting the widget to only accept 'http' and 'https' schemes.

## Affected products

- Checkmk GmbH Checkmk < 2.5.0p5, < 2.4.0p31, < 2.3.0p48, all 2.2.0 versions

## Timeline

- 2026-04-29: patched: Fix released in multiple versions via Werk #17991
- 2026-06-08: disclosed: CVE published to NVD

## References

- [https://checkmk.com/werk/17991](https://checkmk.com/werk/17991)