Checkmk CVE-2025-64998

This vulnerability presents a severe real-world risk despite the lack of a CVSS vector in available data. The attack vector is network-based and requires administrative privileges on a remote site (moderate complexity), but the technical impact is complete: session hijacking enables arbitrary actions on the central site with the privileges of any hijacked user, including full administrative compromise. The vulnerability is not listed as actively exploited in KEV data at this time, and no public proof-of-concept has been identified in the provided intelligence sources. However, the nature of the vulnerability—credential exposure rather than complex exploitation—makes it trivial to exploit once the secret is obtained. Organizations with multi-site Checkmk deployments where remote administrators are not fully trusted represent the highest risk category. The automatable nature of session forging once the secret is disclosed elevates this to a critical priority for patching, particularly in environments where central and remote sites have different trust boundaries.

A malicious or compromised remote site administrator with access to a Checkmk remote site instance with config sync enabled extracts the session signing secret from the synchronized configuration files. The attacker then crafts a forged session cookie signed with this secret for a central site administrator account and injects it into their browser or uses it in an automated attack against the central Checkmk API. The central site accepts the forged session as valid, granting the attacker full administrative access to monitor, modify, or disable critical infrastructure monitoring across the entire organization without leaving obvious authentication logs.