Executive brief
Checkmate is an open-source server monitoring and status page tool that tracks uptime and performance metrics. When a global setting to display URLs is enabled, unauthenticated visitors can access a public API endpoint that inadvertently returns HTTP authentication credentials stored in the system. An attacker can extract these secrets from the JSON response and use them to compromise the monitored services themselves.
Technical details
The vulnerability is an information disclosure flaw in the status page API controller (GET /api/v1/status-page/:url) affecting Checkmate versions 3.3.0 through 3.9.1. When the global showURL setting is enabled, the endpoint returns complete monitor objects including the secret field used for HTTP Authorization headers, even though the frontend does not display this sensitive data. The root cause is a blacklist-based filtering approach that failed to exclude secrets from the JSON response. No authentication is required to exploit this; an unauthenticated attacker can simply query the public API endpoint. The fix, available in version 3.9.2, implements a whitelist approach to explicitly restrict which monitor properties are returned to unauthenticated users.
Affected products
- BlueWave Labs Checkmate 3.3.0 to 3.9.1
Timeline
- 2026-08-21: disclosed
- 2026-07-07: patched: Version 3.9.2 released with fix