Executive brief
Checkmk is an IT infrastructure monitoring platform. A security flaw in its configuration logging allows an administrator to embed malicious code into the system's change logs. If another user views the audit log or the change activation page, this code could execute in their browser, potentially leading to unauthorized actions or data access within the monitoring console.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Checkmk due to improper HTML escaping of new values in the global settings change log. An attacker with administrative privileges to modify global settings can inject malicious payloads into changelog messages. These payloads are executed in the context of other users' sessions when they navigate to the 'Activate Changes' page or the 'Audit log'. The vulnerability is tracked as CVE-2026-8078 and has been addressed in versions 2.5.0p5, 2.4.0p31, and 2.3.0p48.
Affected products
- Checkmk GmbH Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, 2.2.0 (all versions)
Timeline
- 2026-05-08: patched: Fix released in various versions via Werk #17992
- 2026-06-08: disclosed: CVE-2026-8078 published