Skip to main content

Checkmk CVE-2026-33456

| EUVDEUVD-2026-21344 MEDIUM
Improper Neutralization of Delimiters (CWE-140)
2026-04-10 Checkmk
Code Injection Checkmk
5.1
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Apr 16, 2026 - 05:29 EUVD
2.5.0b4,2.4.0p26
EUVD ID Assigned
Apr 10, 2026 - 08:45 euvd
EUVD-2026-21344
Analysis Generated
Apr 10, 2026 - 08:45 vuln.today
CVE Published
Apr 10, 2026 - 08:31 nvd
MEDIUM 5.1

DescriptionCVE.org

Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via a crafted service description.

AnalysisAI

Livestatus injection in Checkmk's notification test mode allows authenticated users with high privileges to inject arbitrary Livestatus commands via crafted service descriptions in versions prior to 2.5.0b4 and 2.4.0p26. The vulnerability has a CVSS score of 5.1 with limited confidentiality and integrity impact, requiring high-privilege authentication. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

Checkmk's notification test functionality processes user-supplied input (specifically service descriptions) without proper sanitization before passing it to the Livestatus query interface. Livestatus is Checkmk's real-time status database protocol; improper input validation allows attackers to break out of the intended query context and inject arbitrary Livestatus commands. This is classified as CWE-140 (Improper Neutralization of Delimiters), indicating a command injection vulnerability where delimiter characters in user input are not properly escaped or validated. The affected product is identified via CPE 2.3:a:checkmk_gmbh:checkmk, with vulnerable versions spanning Checkmk 2.5.0 prior to beta 4 and Checkmk 2.4.0 prior to patch 26.

RemediationAI

Upgrade Checkmk to version 2.5.0b4 or later for the 2.5.x branch, or to version 2.4.0p26 or later for the 2.4.x branch. These patched versions include input sanitization for service descriptions in the notification test mode to prevent Livestatus injection. Organizations unable to patch immediately should restrict access to the notification test page to only essential administrative users and monitor for suspicious Livestatus query patterns in logs. Detailed remediation guidance is available in the Checkmk advisory at https://checkmk.com/werk/17989.

More in Checkmk

View all
CVE-2017-14955 MEDIUM POC
5.9 Oct 02

Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, whi
CVE-2021-40904 HIGH POC
8.8 Mar 25

The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dok
CVE-2021-40905 HIGH POC
8.8 Mar 25

The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uplo
CVE-2024-28825 CRITICAL
9.8 Apr 24

Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta
CVE-2021-36563 MEDIUM POC
5.4 Jul 26

The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the W
CVE-2025-39666 CRITICAL
9.3 Apr 07

Local privilege escalation in Checkmk allows site users with high privileges to escalate to root by manipulating site co
CVE-2024-8606 CRITICAL
9.2 Sep 23

Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass
CVE-2023-31211 HIGH
8.8 Jan 12

Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credent
CVE-2025-32918 HIGH
8.8 Jul 04

A security vulnerability in autocomplete endpoint within the RestAPI of Checkmk (CVSS 8.8) that allows an authenticated

CVE-2023-6735 HIGH
8.8 Jan 12

Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escal
CVE-2023-6740 HIGH
8.8 Jan 12

Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user t
CVE-2024-28828 HIGH
8.8 Jul 10

Cross-Site request forgery in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) could lead to 1-click com

Same weakness CWE-140 – Improper Neutralization of Delimiters

View all
CVE-2025-32918 HIGH
8.8
CVE-2023-6157 HIGH
8.8
CVE-2023-6156 HIGH
8.8
CVE-2023-38488 HIGH
8.8
CVE-2023-31208 HIGH
8.8
CVE-2024-42392 HIGH
7.5
CVE-2024-42385 HIGH
7.0
CVE-2025-48879 MEDIUM
6.5

Same technique Code Injection

View all
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8

Share

CVE-2026-33456 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy