Checkmate CVE-2026-70656

Exploitation requires an authenticated session with admin or superadmin role within the Checkmate application - these are the only roles permitted to configure monitor settings per the advisory. The advanced HTTP monitor type must be in use, with matchMethod explicitly set to 'regex' and the attacker-controlled expectedValue field containing the malicious pattern. Because the monitor periodically re-evaluates against its target URL's HTTP response body, the attacker also benefits from controlling or knowing the content of the monitored endpoint to maximize backtracking. Exploitation is limited by: the PR:H requirement (no unauthenticated or low-privilege path exists), the need to create or modify monitor configurations rather than simply sending a crafted request to an open endpoint, and the self-hosted nature of the product (no shared cloud instance to cross-tenant attack). Once triggered, the denial of service affects all platform users until the Node.js process is restarted.

Despite a CVSS base score of only 4.9 (Medium), the availability impact is total - a single admin-crafted regex can render the entire Checkmate instance unresponsive for all users. The PR:H constraint is the primary risk limiter: exploitation requires an established admin or superadmin session, reducing the attack surface to insider threats, compromised privileged accounts, or post-breach lateral movement. No EPSS score was provided in the input data, and the absence of KEV listing and public POC suggests this has not been observed in active exploitation campaigns. The CVSS Availability:High rating is well-grounded - Node.js single-threaded event loop starvation is a well-understood, reliably reproducible impact. The attack complexity (AC:L) reflects that no special environment conditions are needed beyond the admin UI access. The scope is Unchanged (S:U), correctly indicating the blast radius is limited to the Checkmate process itself rather than adjacent systems. Practically, this is a medium-priority finding for organizations where Checkmate admin access is tightly controlled; it becomes higher priority where admin credentials are broadly shared or where the monitoring platform is operationally critical to SLA compliance.

An authenticated Checkmate admin navigates to the HTTP monitor configuration UI, creates or edits a monitor, sets matchMethod to 'regex', and enters a catastrophically backtracking pattern such as (a+)+$ in the expectedValue field while pointing the monitor target at a URL that returns a long string of 'a' characters. When the monitor scheduler triggers an evaluation, Node.js's main event loop blocks indefinitely while evaluating the pattern, rendering all API endpoints, monitor checks, and WebSocket connections for every platform user unavailable until the process is manually restarted. No public proof-of-concept exploit was identified at time of analysis, but the attack requires only standard HTTP monitor configuration UI access.