Is CVE-2026-85390 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85390 being exploited in the wild.

How severe is CVE-2026-85390?

High severity, with a CVSS score of 7.1, published 3 September 2026.

Which products and versions are affected?

Bluewave-Labs Checkmate through 3.11.0.

Is there a fix for CVE-2026-85390?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85390 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85390?

Check whether you run Bluewave-Labs Checkmate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85390: Checkmate missing role guard middleware on maintenance and check routes

CVE-2026-85390 · Severity: high · CVSS 7.1 · Published 2026-09-03

Checkmate is an open-source server monitoring and uptime tracking tool. The application failed to enforce proper role-based access controls on certain administrative routes, allowing low-privilege users to create maintenance windows that silence alerts, modify notification settings, and delete monitoring check history. This enables attackers to cover up security incidents and disrupt monitoring alerting.

Technologies: Bluewave-Labs Checkmate. Vendors: Bluewave-Labs.

Quick answers

Is CVE-2026-85390 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85390 being exploited in the wild.
How severe is CVE-2026-85390?: High severity, with a CVSS score of 7.1, published 3 September 2026.
Which products and versions are affected?: Bluewave-Labs Checkmate through 3.11.0.
Is there a fix for CVE-2026-85390?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85390 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85390?: Check whether you run Bluewave-Labs Checkmate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken access control (authorization bypass) in Checkmate through version 3.11.0. The affected routes (maintenance-window, notification, and check-deletion endpoints) are missing the isAllowed middleware that enforces role-based access control. While read-only and standard user-role sessions should be restricted from these administrative functions, the missing middleware allows any authenticated user to invoke them. Attackers with valid user-role credentials can create arbitrary maintenance windows to suppress alerts, modify notification channels, and delete check history to erase incident evidence. The vulnerability requires network access and valid authentication credentials. Fixes involve applying the isAllowed role guard middleware to the vulnerable routes.

Affected products

Bluewave Labs Checkmate through 3.11.0

Timeline

2026-09-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.