Checkmk CVE-2025-65000

Requires an authenticated Checkmk user with access to view the 'Remote alert handlers (Linux)' rule configuration page (PR:L); the SSH private key is disclosed in that page's rendered HTML source. To actually abuse the key, the specific alert handler must already be deployed on target hosts - this is the AT:P attack requirement and the main limiting factor. This is NOT remote unauthenticated exploitation: an existing low-privilege account and a pre-deployed Linux remote alert handler are both prerequisites, which sharply narrows realistic exploitation to insiders or attackers who already hold Checkmk credentials.

This is a low real-world priority despite the 'Authentication Bypass' tag. Multiple signals agree on low risk: the vendor CVSS 4.0 base score is 2.3 (Low), EPSS is only 0.22% (11th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:L) shows the attack is network-reachable but requires an already-authenticated low-privilege Checkmk user (PR:L) and a present attack requirement (AT:P) - namely that the Linux remote alert handler is actually deployed on target hosts. Impact is modest: low confidentiality on the Checkmk system (the leaked key) plus low subsequent-system integrity/availability on managed hosts. No signals conflict - they consistently point to a minor information-exposure issue (CWE-212) rather than a widespread threat. The one nuance worth flagging: leaked SSH private keys have durable post-compromise value, so an insider or an attacker who has already gained a Checkmk account could abuse this to reach downstream hosts; that elevates it above trivial for already-breached environments but not for external unauthenticated risk.

An authenticated low-privilege Checkmk user opens the 'Remote alert handlers (Linux)' rule configuration page and reads the SSH private key embedded directly in the page's HTML source. Using that key, the user triggers predefined alert handlers on any host where the handler is deployed, causing those handler actions to run without authorization. No public exploit code is known; exploitation is manual and requires an existing account.