Checkmk CVE-2026-33456

This vulnerability presents moderate real-world risk despite its CVSS 5.1 score. The CVSS vector shows network-accessible attack surface (AV:N) with low complexity (AC:L), but critically requires high privileges (PR:H), which substantially limits the threat pool to administrative or privileged monitoring users. The impact is confined to partial confidentiality and integrity loss (VC:L, VI:L, VA:L) with no scope expansion, reflecting that injected commands operate within the same privilege context. EPSS data is not provided, but the authentication requirement combined with limited impact suggests this is a lower-priority vulnerability for most organizations unless administrative users are untrusted or accounts are frequently compromised. Organizations with strict privilege separation and strong access controls should deprioritize this relative to unauthenticated or low-privilege vulnerabilities. The patch availability and specific version fixes indicate this is a known, addressable risk rather than an emerging critical threat.

An authenticated administrator or high-privilege user with access to the notification test page crafts a service description containing specially formatted Livestatus syntax (e.g., newlines or pipe characters) that breaks out of the intended query structure. Upon submitting the notification test, the injected commands are executed against the Livestatus interface, potentially allowing the attacker to query or modify arbitrary monitoring data within the Checkmk instance. Since the attacker must already possess high-level credentials and direct access to the web interface, this threat is primarily relevant in scenarios where privileged accounts are compromised or when internal users are not fully trusted.