# CVE-2026-8078: Checkmk stored XSS in global settings change log

Source: https://junglewise.ai/threats/cve-2026-8078-checkmk-stored-xss-in-global-settings-change-log  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-8078 · Severity: info · CVSS 4.8 · Published 2026-06-08

Checkmk is an IT infrastructure monitoring platform. A security flaw in its configuration logging allows an administrator to embed malicious code into the system's change logs. If another user views the audit log or the change activation page, this code could execute in their browser, potentially leading to unauthorized actions or data access within the monitoring console.

## Quick answers

**Is CVE-2026-8078 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8078 being exploited in the wild.

**How severe is CVE-2026-8078?** Informational severity, with a CVSS score of 4.8, published 8 June 2026.

**Which products and versions are affected?** Checkmk GmbH Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, 2.2.0 (all versions).

**Is there a fix for CVE-2026-8078?** A patch was published on 2026-05-08: Fix released in various versions via Werk #17992 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8078 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8078?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Checkmk due to improper HTML escaping of new values in the global settings change log. An attacker with administrative privileges to modify global settings can inject malicious payloads into changelog messages. These payloads are executed in the context of other users' sessions when they navigate to the 'Activate Changes' page or the 'Audit log'. The vulnerability is tracked as CVE-2026-8078 and has been addressed in versions 2.5.0p5, 2.4.0p31, and 2.3.0p48.

## Affected products

- Checkmk GmbH Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, 2.2.0 (all versions)

## Timeline

- 2026-05-08: patched: Fix released in various versions via Werk #17992
- 2026-06-08: disclosed: CVE-2026-8078 published

## References

- [https://checkmk.com/werk/17992](https://checkmk.com/werk/17992)