Checkmk CVE-2026-17548

Exploitation requires a valid Checkmk user account, confirmed by the CVSS 4.0 PR:L metric. The attacker must know or enumerate the numeric ID of a target background job; because Checkmk job IDs are sequential, any authenticated user can discover valid IDs by iterating from a known starting value. No special configuration, feature toggle, or elevated privilege beyond basic authentication is required. Exploitation is strictly limited to reading job status and output - no write, delete, or privilege escalation capability is implied. Impact is bounded to the confidentiality of background job data on affected instances running vulnerable versions.

The CVSS 4.0 score of 5.3 (Medium) accurately captures the constrained scope: only confidentiality is affected and only within the authenticated session context, with no downstream system impact. No EPSS data was present in the supplied intelligence, and no KEV listing or confirmed POC exists, indicating this is not currently subject to opportunistic mass exploitation. Background job IDs in Checkmk are typically sequential integers, which means enumeration is trivial for any authenticated user - this functionally lowers attack complexity below what AC:L alone conveys for a broad audience. In multi-tenant or multi-team Checkmk deployments where different operators manage distinct monitoring domains, a lateral read across job boundaries represents a meaningful confidentiality breach even at a medium CVSS score, and the absence of EPSS data means exploitation likelihood cannot be independently quantified. No conflicting signals between data sources were observed, though the absence of both EPSS and KEV data limits confidence in exploitation likelihood assessment.

An authenticated Checkmk user with a low-privilege account iterates over background job IDs - which are typically sequential integers - by sending crafted API requests to the background job status endpoint. The user retrieves results from discovery scans or report jobs initiated by administrators, potentially exposing network device inventories, configuration data, or other sensitive operational output from jobs they were not authorized to access. No public exploit code has been identified at time of analysis.