Is there a patch available for CVE-2026-33455?

Yes, a patch is available for CVE-2026-33455. Update the affected software to the latest version immediately.

Checkmk CVE-2026-33455

Q: What is the CVSS score of CVE-2026-33455?

CVE-2026-33455 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: Which versions of Checkmk are affected by CVE-2026-33455?

Livestatus injection in Checkmk's monitoring quicksearch function allows authenticated attackers to inject arbitrary livestatus commands through insufficiently sanitized search query parameters in…. A patch is available.

EUVD-2026-21342 MEDIUM

Improper Neutralization of Delimiters (CWE-140)

2026-04-10 Checkmk

GHSA-p2v5-ghx9-jg75

Code Injection Checkmk

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.5.0b4

EUVD ID Assigned

Apr 10, 2026 - 08:45 euvd

EUVD-2026-21342

Analysis Generated

Apr 10, 2026 - 08:45 vuln.today

CVE Published

Apr 10, 2026 - 08:30 nvd

MEDIUM 5.3

DescriptionCVE.org

Livestatus injection in the monitoring quicksearch in Checkmk <2.5.0b4 allows an authenticated attacker to inject livestatus commands via the search query due to insufficient input sanitization in search filter plugins.

AnalysisAI

Livestatus injection in Checkmk's monitoring quicksearch function allows authenticated attackers to inject arbitrary livestatus commands through insufficiently sanitized search query parameters in versions prior to 2.5.0b4. The vulnerability requires valid authentication credentials and enables low-impact information disclosure and limited integrity/availability changes within the monitoring system. No public exploit code or active exploitation has been reported at time of analysis.

Technical ContextAI

Checkmk's quicksearch feature uses Livestatus, the standard query interface for monitoring data retrieval, to process search filters. The vulnerability stems from CWE-140 (Improper Neutralization of Delimiters), where search filter plugins fail to properly sanitize user-supplied input before constructing Livestatus commands. An authenticated attacker can craft malicious search queries containing Livestatus metacharacters or command syntax to bypass intended query boundaries and execute unintended operations against the monitoring backend. The affected CPE (cpe:2.3:a:checkmk_gmbh:checkmk:*:*:*:*:*:*:*:*) indicates all Checkmk instances below version 2.5.0b4 are vulnerable.

RemediationAI

Upgrade Checkmk to version 2.5.0b4 or later, where input sanitization in search filter plugins has been corrected. Administrators should prioritize this patch if running 2.5.0 beta versions in production. As an interim mitigation, restrict quicksearch functionality to trusted users or apply network-level access controls to limit who can access Checkmk's monitoring interface. For detailed patching instructions and confirmation of version compatibility, refer to https://checkmk.com/werk/17988. If upgrading is not immediately feasible, audit Checkmk user accounts and disable unnecessary monitoring access for non-administrative staff.