Checkmk CVE-2026-33457

The CVSS 5.3 score reflects a network-accessible vulnerability with low attack complexity that requires prior authentication (PR:L per CVSS vector). The limited scope and impact ratings (VC:L/VI:L/VA:L) indicate that successful exploitation results in partial compromise of confidentiality, integrity, and availability within the Livestatus subsystem only, not system-wide impact. The vulnerability is confined to authenticated users with valid Checkmk credentials, significantly reducing real-world risk compared to unauthenticated injection flaws. EPSS and exploitation probability data are not provided in the available intelligence, but the technical nature of the flaw (Livestatus injection) and authentication requirement suggest moderate real-world risk for organizations where multiple users have Checkmk access or where account compromise is a concern. This is a legitimate authenticated injection vulnerability warranting patching, but it does not pose critical infrastructure risk to properly segmented monitoring deployments.

An authenticated Checkmk user with permission to view monitoring data crafts a service name containing Livestatus command delimiters and injection syntax (e.g., including newline characters or command separators). When the user navigates to the prediction graph page and the vulnerable code processes this service name, the injected Livestatus commands are executed against the monitoring database. This could allow the attacker to query unauthorized monitoring data or modify graph predictions. No public proof-of-concept code or confirmed active exploitation has been reported at the time of this analysis; the vulnerability requires valid Checkmk credentials to trigger.