Checkmk CVE-2026-3466

Attacker must possess authenticated access to Checkmk with dashboard creation privileges (not default end-user permissions - requires at least editor or power-user role). Victim must have access to shared dashboards and must actively click on the crafted dashlet title link within the malicious dashboard (UI:A requirement - not automatically triggered on page load). Exploitation is limited to the Checkmk web interface context (AV:N/AC:L indicates remotely accessible but requires the specific dashboard sharing workflow). Organizations that restrict dashboard creation to administrators-only or disable dashboard sharing features are not vulnerable. The low attack complexity (AC:L) indicates no special timing, race conditions, or complex configuration requirements once the prerequisite privileges are obtained.

Real-world risk is moderate despite the 8.5 CVSS score. Attack complexity is low (AC:L), but exploitation requires two significant prerequisites: attacker must have authenticated dashboard creation privileges (PR:L), and victim must actively click the malicious dashlet link (UI:A). SSVC framework rates this as non-automatable with no current exploitation evidence, aligning with EPSS 0.05% (14th percentile) - suggesting limited appeal for mass exploitation. However, SSVC technical impact is 'total', and CVSS shows high confidentiality/integrity/availability impact (VC:H/VI:H/VA:H) with limited subsequent-system integrity impact (SI:L). This profile fits targeted attacks within organizations where insider threats or compromised low-privileged accounts exist. The requirement for victim interaction and authenticated attacker substantially reduces risk compared to unauthenticated, non-interactive vulnerabilities. Primary risk is session hijacking, credential theft, or privilege escalation via JavaScript execution in administrator contexts. Organizations with strict dashboard access controls and security-aware users face lower practical risk. No public exploit identified and low EPSS score suggest attackers currently favor easier targets, but the stored nature means a single successful injection affects all dashboard viewers.

An attacker with low-privileged authenticated access to Checkmk creates a dashboard with a dashlet containing a malicious JavaScript payload embedded in the title link field (e.g., <a href='#' onclick='malicious_code()'>). The attacker shares this dashboard with administrators or other users. When a victim clicks the dashlet title link, the stored JavaScript executes in their browser context with their session privileges, allowing the attacker to steal session cookies, perform actions as the victim, or pivot to further system compromise. The stored nature means the payload persists and affects all users who subsequently interact with the dashboard.