Which versions of Checkmk are affected by CVE-2026-20915?

Checkmk 2.5.0 beta contains a stored XSS vulnerability that allows authenticated users with change permissions to inject malicious scripts into the Pending Changes sidebar, affecting all users who…. A patch is available.

How to fix or mitigate CVE-2026-20915?

Within 24 hours: Identify all Checkmk 2.5.0 beta deployments in your environment and restrict access to Pending Changes features via role-based access controls. Within 7 days: Apply vendor-released patch to Checkmk 2.5.0b2 or later. Within 30 days: Conduct a security audit of user permissions to ensure principle of least privilege; audit authentication logs for suspicious change activity during the window before patching.

Checkmk CVE-2026-20915

Q: What is the CVSS score of CVE-2026-20915?

CVE-2026-20915 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17417 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-31 Checkmk

XSS Checkmk

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:10 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.5.0b2

EUVD ID Assigned

Mar 31, 2026 - 14:30 euvd

EUVD-2026-17417

Analysis Generated

Mar 31, 2026 - 14:30 vuln.today

CVE Published

Mar 31, 2026 - 13:51 nvd

HIGH 8.5

DescriptionCVE.org

Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar.

AnalysisAI

Stored cross-site scripting (XSS) in Checkmk 2.5.0 beta allows authenticated users with pending change permissions to inject malicious JavaScript into the Pending Changes sidebar, executing in the browsers of other users who view that sidebar. This vulnerability affects the beta release 2.5.0 before version 2.5.0b2 and requires existing user authentication with specific permissions to exploit.

Technical ContextAI

The vulnerability stems from improper sanitization of user-supplied input in the Pending Changes sidebar feature of Checkmk, a monitoring and alerting platform. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw where user-controlled data is rendered in HTML context without adequate encoding or filtering. Authenticated users with permissions to create pending changes can inject arbitrary JavaScript payloads that persist in the application's data store. When other users subsequently view the Pending Changes sidebar, their browsers execute the injected script in the security context of the Checkmk application, enabling session hijacking, credential theft, or further lateral movement within the monitoring infrastructure.

RemediationAI

Upgrade to Checkmk version 2.5.0b2 or later to remediate this vulnerability. Users unable to upgrade immediately should restrict permissions for pending change creation to highly trusted administrators only, and monitor the Pending Changes sidebar for suspicious or unexpected entries. Review audit logs for any unauthorized pending change creation during the time period before patching. Refer to the official Checkmk advisory at https://checkmk.com/werk/19526 for additional details and verification of patch deployment.