Checkmk CVE-2026-14452

Exploitation requires that the victim be an authenticated Checkmk user with Setup access, and that this user be socially engineered into opening an attacker-crafted URL AND then clicking the Reset button or submitting an empty search in the Setup in-page search - the script does not fire automatically on page load. Limiting factors: active user interaction (UI:A) is mandatory, the target must already hold privileged Setup access, and affected versions are Checkmk before 2.5.0p15, before 2.4.0p38, before 2.3.0p51, and the EOL 2.2.0 branch; fully patched instances are not exploitable.

This is a client-side vulnerability (CWE-601 Open Redirect with a reflected cross-site-scripting component) in Checkmk's Setup in-page search, improperly validating the reset_url parameter. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) correctly reflects that no attacker authentication is needed but active user interaction IS required - the victim must open a crafted URL and then click the Reset button or submit an empty search. This UI:A requirement is the single largest factor lowering real-world risk: exploitation is not autonomous and depends on social engineering of a specific privileged user. The VC:H/VI:H impact rating is plausible because the script executes in the session of an authenticated user holding Setup (administrative configuration) access, so a successful attack can read or alter monitoring configuration; however VA:H (availability high) in the vendor vector is questionable for an XSS/redirect flaw and I have independently downgraded it. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active or probable near-term exploitation - this reads as a legitimately-rated but not emergency-priority issue, chiefly because it is interaction-dependent and targets only users who already hold Setup privileges. Conflicting signal to note: the CVSS vector shows PR:N (attacker needs no privileges) while the vulnerability only has impact if the *victim* is an authenticated Setup user - the privilege burden sits on the target, not the attacker.

An attacker crafts a malicious Checkmk Setup search URL with a tampered reset_url parameter and delivers it (e.g. via email or chat) to a Checkmk administrator who holds Setup access. When the administrator opens the link and clicks Reset or submits an empty search, injected script runs in their authenticated session or they are silently redirected to an attacker-controlled external site. No public exploit code was identified at time of analysis.