What is the CVSS score of CVE-2026-24097?

CVE-2026-24097 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Checkmk are affected by CVE-2026-24097?

Organizations using Checkmk should be aware of moderate risk from CVE-2026-24097 rated CVSS 4.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-24097?

Within 30 days: Identify affected systems running Checkmk and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Checkmk CVE-2026-24097

EUVD-2026-11782 MEDIUM

Observable Response Discrepancy (CWE-204)

2026-03-13 Checkmk

Information Disclosure Checkmk

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.3.0p43,2.4.0p23

EUVD ID Assigned

Mar 13, 2026 - 10:00 euvd

EUVD-2026-11782

Analysis Generated

Mar 13, 2026 - 10:00 vuln.today

CVE Published

Mar 13, 2026 - 09:40 nvd

MEDIUM 4.3

DescriptionCVE.org

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows authenticated users to enumerate existing hosts by observing different HTTP response codes in agent-receiver/register_existing endpoint, which could lead to information disclosure.

AnalysisAI

Checkmk contains an improper permission enforcement vulnerability in the agent-receiver/register_existing endpoint that allows authenticated users to enumerate existing hosts by observing differential HTTP response codes, enabling information disclosure. This affects Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and the end-of-life 2.2.0 branch. While not currently listed as actively exploited in known vulnerability catalogs, the low CVSS score of 5.3 reflects limited confidentiality impact and the requirement for prior authentication, though the straightforward nature of the enumeration technique presents moderate real-world risk.

Technical ContextAI

The vulnerability exists in Checkmk's agent-receiver registration endpoint, which handles host registration operations. The root cause is classified under CWE-204 (Observable Discrepancy), a category describing scenarios where different system behaviors or response codes leak information to unauthorized parties. In this case, the endpoint fails to enforce consistent permission checks across all code paths, resulting in timing or HTTP response code variations (likely 200 vs 404 or similar) when an authenticated user probes for the existence of hosts they should not have access to. Checkmk is an open-source infrastructure monitoring and IT automation platform built on Python and web technologies. The affected products are identified through CPE strings in Checkmk versions 2.4.x, 2.3.x, and 2.2.x branches, with the agent-receiver component being a REST API service responsible for agent registration and host provisioning workflows.

RemediationAI

Immediately upgrade affected Checkmk installations to version 2.4.0p23 or later for the 2.4 branch, or to version 2.3.0p43 or later for the 2.3 branch. For organizations still running the end-of-life 2.2.0 branch, migration to a supported version is strongly recommended. As interim mitigations prior to patching, restrict network access to the agent-receiver endpoint at the firewall or reverse proxy layer to only trusted monitoring agents and administrative hosts, implement strict authentication controls and audit logging on the endpoint to detect enumeration attempts, and disable the agent-receiver functionality entirely if not actively in use. Additionally, review access logs for suspicious patterns of HTTP response code observation that may indicate host enumeration probing. Monitor vendor security bulletins for confirmation of patch availability and apply updates according to your change management procedures.