Checkmk CVE-2026-24097

The CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N indicates a medium-severity issue with network attack vector, low complexity, and low confidentiality impact, but critically requires prior authentication (PR:L) and causes no integrity or availability impact. The authentication requirement significantly reduces attack surface compared to unauthenticated vulnerabilities. While EPSS data is not provided in the intelligence package, the observable discrepancy class of vulnerability typically demonstrates high exploitability once discovered due to its straightforward nature (simple HTTP request observation requires no special payload crafting). The lack of active exploitation status and POC in known vulnerability databases suggests this is not yet weaponized in the wild. However, the combination of network accessibility, low technical complexity, and the triviality of the exploitation technique (differential response observation) means that once details are public, opportunistic exploitation by insiders or low-skilled attackers with network access is probable. The real-world priority should be moderate to elevated for organizations running Checkmk in environments with untrusted authenticated users, but lower for isolated monitoring deployments with strong access controls.

An authenticated user with legitimate access to a Checkmk monitoring instance but lacking permissions to view certain hosts can systematically probe the agent-receiver/register_existing endpoint with different hostname guesses and observe HTTP response codes to determine which hosts exist in the system. For example, sending a POST request with a guessed hostname returns a 409 Conflict if the host exists, versus a 400 Bad Request if it does not, allowing the attacker to enumerate the entire inventory of monitored infrastructure. This technique requires only network-level access to the Checkmk API and the ability to authenticate (such as a standard monitoring user account), making it accessible to insider threats or users with compromised credentials.