Which versions of Checkmk are affected by CVE-2026-33276?

Checkmk versions 2.5.0 beta before 2.5.0b2 contain a stored XSS vulnerability in the Unified Search feature that allows authenticated users with host/service permissions to inject malicious code…. A patch is available.

How to fix or mitigate CVE-2026-33276?

Within 24 hours: identify all Checkmk instances running 2.5.0 beta versions before 2.5.0b2 using inventory tools or direct version queries (check /omd/versions or web UI 'About' page). Within 7 days: upgrade to Checkmk 2.5.0b2 or later, or revert to stable 2.4.x release if beta stability is not required. Within 30 days: audit access logs for any unauthorized JavaScript injection attempts in the Unified Search feature and review user permissions to restrict host/service creation to only necessary administrative accounts.

Checkmk CVE-2026-33276

Q: What is the CVSS score of CVE-2026-33276?

CVE-2026-33276 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17429 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-31 Checkmk

XSS Checkmk

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:10 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.5.0b2

EUVD ID Assigned

Mar 31, 2026 - 14:30 euvd

EUVD-2026-17429

Analysis Generated

Mar 31, 2026 - 14:30 vuln.today

CVE Published

Mar 31, 2026 - 13:44 nvd

HIGH 8.6

DescriptionCVE.org

Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to execute arbitrary JavaScript in the browsers of other users performing searches in the Unified Search feature.

AnalysisAI

Stored cross-site scripting (XSS) in Checkmk 2.5.0 beta versions before 2.5.0b2 allows authenticated users with host or service creation permissions to inject malicious JavaScript that executes in the browsers of other users when they perform searches via the Unified Search feature, potentially enabling session hijacking, credential theft, or administrative account compromise.

Technical ContextAI

This is a stored XSS vulnerability (CWE-79) in Checkmk's Unified Search functionality. The vulnerability arises from insufficient input sanitization on host or service creation endpoints, where user-supplied data is stored in the backend database without proper HTML encoding or content security policy enforcement. When other users trigger searches that retrieve and display these stored payloads, the malicious JavaScript executes in their browser context with their authentication privileges. Checkmk is a comprehensive infrastructure monitoring and alerting platform that centralizes monitoring of IT infrastructure; the Unified Search feature aggregates results across hosts, services, and other monitored entities.

RemediationAI

The primary fix is to upgrade to Checkmk 2.5.0b2 or later. Users running the affected beta version (2.5.0 before 2.5.0b2) should immediately apply this upgrade, which includes input sanitization fixes for the host and service creation endpoints. In the interim, restrict the creation of hosts and services to trusted administrative accounts, and monitor Unified Search usage for anomalous queries that may indicate exploitation attempts. Organizations using stable release versions (2.4.x or earlier, or 2.5.0 final) are not affected and do not require action. Refer to the Checkmk advisory at https://checkmk.com/werk/19525 for detailed upgrade instructions and confirmation of fix inclusion.