Executive brief
Checkmk, a popular IT infrastructure monitoring platform, is affected by a security vulnerability in its service discovery component. An administrator with the ability to configure monitoring checks can inject malicious scripts that execute in the browsers of other administrators or authorized users. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Checkmk due to improper HTML escaping of active or custom check outputs on the service discovery page. When a user clicks 'Run check', the application inserts the check output directly into the DOM without sanitization. An attacker with administrative privileges (required to configure these checks) can store a malicious payload that executes when another administrator or a user with host read permissions triggers the check execution. The vulnerability is addressed in versions 2.5.0p5, 2.4.0p31, and 2.3.0p48.
Affected products
- Checkmk GmbH Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, all 2.2.0 versions
Timeline
- 2026-05-26: patched: Fix released in various versions via Werk #17993
- 2026-06-08: disclosed: CVE published