What is the CVSS score of CVE-2026-2859?

CVE-2026-2859 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Checkmk are affected by CVE-2026-2859?

Organizations using Checkmk should be aware of moderate risk from CVE-2026-2859 rated CVSS 4.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-2859?

Within 30 days: Identify affected systems running Checkmk and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Checkmk CVE-2026-2859

EUVD-2026-11784 MEDIUM

Observable Response Discrepancy (CWE-204)

2026-03-13 Checkmk

Information Disclosure Checkmk

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.3.0p43,2.4.0p23

EUVD ID Assigned

Mar 13, 2026 - 10:00 euvd

EUVD-2026-11784

Analysis Generated

Mar 13, 2026 - 10:00 vuln.today

CVE Published

Mar 13, 2026 - 09:40 nvd

MEDIUM 4.3

DescriptionCVE.org

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in deploy_agent endpoint, which could lead to information disclosure.

AnalysisAI

Checkmk contains an improper permission enforcement vulnerability in the deploy_agent endpoint that allows unauthenticated users to enumerate existing hosts by analyzing differential HTTP response codes, resulting in information disclosure. The vulnerability affects Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and end-of-life version 2.2.0, with a CVSS score of 6.3 indicating moderate severity. An attacker with network access can passively discover the infrastructure topology without authentication, though no known active exploitation or public POC has been confirmed at this time.

Technical ContextAI

Checkmk is an open-source infrastructure monitoring and alerting platform that manages deployment of monitoring agents across distributed systems. The vulnerability exists in the deploy_agent REST API endpoint (likely accessible via HTTP/HTTPS at paths such as /api/v0/objects/hosts or related deployment routes) where the application returns different HTTP status codes based on whether a queried hostname exists in the system, even when the requesting user is unauthenticated. This violates CWE-204 (Observable Discrepancy), a weakness where observable differences in application behavior inadvertently reveal information about the system's internal state. The root cause is the absence of proper authentication and authorization checks before the endpoint responds to host enumeration requests; rather than returning a uniform 401 Unauthorized or 403 Forbidden response, the endpoint leaks information through response code variation (e.g., 404 for non-existent hosts, 200 or 403 for existing hosts), allowing an attacker to map the monitored infrastructure without credentials.

RemediationAI

Immediately upgrade Checkmk to version 2.4.0p23 or later for the 2.4.x branch, version 2.3.0p43 or later for the 2.3.x branch, or discontinue use of unsupported version 2.2.0 and migrate to a supported release. Consult the official Checkmk security advisory and patch release notes for detailed upgrade procedures specific to your deployment model (raw, docker, appliance). As an interim compensating control pending patching, restrict network access to the deploy_agent endpoint and all Checkmk API routes to trusted internal networks and authenticated monitoring agents only, implement a reverse proxy with authentication enforcement in front of Checkmk, and monitor HTTP access logs for suspicious enumeration patterns such as repeated 404 responses or sequential host naming attempts. After patching, verify that the endpoint now consistently returns authentication-required responses to unauthenticated requests regardless of host existence.