Is CVE-2026-71862 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71862 being exploited in the wild.

How severe is CVE-2026-71862?

High severity, with a CVSS score of 7.5, published 21 August 2026.

Which products and versions are affected?

Bluewave-Labs Checkmate 3.3.0 to 3.9.1.

Is there a fix for CVE-2026-71862?

A patch was published on 2026-07-07: Version 3.9.2 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71862 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-71862?

Check whether you run Bluewave-Labs Checkmate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71862: Checkmate credential exposure in public status pages

CVE-2026-71862 · Severity: high · CVSS 7.5 · Published 2026-08-21

Checkmate is an open-source server monitoring and status page tool that tracks uptime and performance metrics. When a global setting to display URLs is enabled, unauthenticated visitors can access a public API endpoint that inadvertently returns HTTP authentication credentials stored in the system. An attacker can extract these secrets from the JSON response and use them to compromise the monitored services themselves.

Technologies: Bluewave-Labs Checkmate. Vendors: Bluewave-Labs.

Quick answers

Is CVE-2026-71862 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71862 being exploited in the wild.
How severe is CVE-2026-71862?: High severity, with a CVSS score of 7.5, published 21 August 2026.
Which products and versions are affected?: Bluewave-Labs Checkmate 3.3.0 to 3.9.1.
Is there a fix for CVE-2026-71862?: A patch was published on 2026-07-07: Version 3.9.2 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71862 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-71862?: Check whether you run Bluewave-Labs Checkmate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure flaw in the status page API controller (GET /api/v1/status-page/:url) affecting Checkmate versions 3.3.0 through 3.9.1. When the global showURL setting is enabled, the endpoint returns complete monitor objects including the secret field used for HTTP Authorization headers, even though the frontend does not display this sensitive data. The root cause is a blacklist-based filtering approach that failed to exclude secrets from the JSON response. No authentication is required to exploit this; an unauthenticated attacker can simply query the public API endpoint. The fix, available in version 3.9.2, implements a whitelist approach to explicitly restrict which monitor properties are returned to unauthenticated users.

Affected products

BlueWave Labs Checkmate 3.3.0 to 3.9.1

Timeline

2026-08-21: disclosed
2026-07-07: patched: Version 3.9.2 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.