Executive brief
Checkmk is a monitoring and alerting platform that tracks the health of IT infrastructure. An authenticated user can inject specially crafted filter values into the monitoring API to bypass visibility restrictions, view information about hosts and services they shouldn't have access to, and exhaust server resources by keeping workers occupied indefinitely.
Technical details
Improper neutralization of newlines in filter values in the monitoring host and service list APIs allows authenticated users to inject additional Livestatus query headers through crafted filter parameters. This enables bypassing object visibility restrictions based on contact groups in count queries and injecting wait headers to tie up web server and Livestatus worker processes for an attacker-controlled duration.
Affected products
- Checkmk Checkmk 2.5.0 before 2.5.0p14, 3.0.0 before 3.0.0b1
Timeline
- 2026-09-22: disclosed
- 2026-09-04: patched