Checkmk CVE-2026-20915

Requires Checkmk 2.5.0 (beta) before 2.5.0b2. Attacker must be authenticated with permission to create pending changes. Victims must view the Pending Changes sidebar; malicious JavaScript executes in their browsers.

While CVSS vector data is unavailable, the vulnerability exhibits moderate real-world risk despite the beta classification. The attack requires existing user authentication and specific role-based permissions (pending change creation rights), limiting the attacker pool to trusted insiders or compromised accounts. However, stored XSS executed in a monitoring platform's web interface poses significant risk because Checkmk administrators and operators routinely access dashboards and sidebars, making exploitation likely if a malicious actor gains initial access. The targeting of beta software (2.5.0 before 2.5.0b2) suggests this was caught early in the release cycle, reducing production impact. No public exploit code or active CISA KEV designation is evident from available data, indicating limited active exploitation. The lack of CVSS scoring and absence of POC data suggest this may be a vendor-disclosed issue with limited external visibility. Priority should be elevated for Checkmk deployments where untrusted users have pending change permissions or where administrative accounts are compromised.

A disgruntled system administrator or attacker who has compromised an administrator account injects a malicious JavaScript payload into a pending change entry, such as embedding a keylogger or session-stealing code. When another Checkmk operator views the Pending Changes sidebar to review pending infrastructure changes, the injected script executes silently in their browser, potentially capturing their authentication token or redirecting them to a phishing page to harvest credentials. The attacker then uses the stolen credentials to gain persistent access to the monitoring system or underlying monitored infrastructure.