Which versions of Checkmk are affected by CVE-2026-7186?

Checkmk monitoring platform (versions <2.5.0p5, <2.4.0p31, <2.3.0p48, all 2.2.x) contains a stored XSS vulnerability allowing low-privileged dashboard editors to inject JavaScript that executes in…. A patch is available.

How to fix or mitigate CVE-2026-7186?

Within 24 hours: Identify all Checkmk deployments and versions in your environment; audit staff holding dashboard editing rights. Within 7 days: Restrict dashboard editing access to 2-3 senior administrators only; audit and remove any javascript: URIs from existing dashboards; enable comprehensive logging for dashboard modifications. Within 30 days: Upgrade to Checkmk 2.5.0p5 or later (if on 2.5.x), 2.4.0p31 or later (if on 2.4.x), 2.3.0p48 or later (if on 2.3.x), or upgrade from 2.2.x to 2.3.0p48 or newer since 2.2.x line has no patch available.

Checkmk CVE-2026-7186

Q: What is the CVSS score of CVE-2026-7186?

CVE-2026-7186 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: How to fix or mitigate CVE-2026-7186?

Within 24 hours: Identify all Checkmk deployments and versions in your environment; audit staff holding dashboard editing rights. Within 7 days: Restrict dashboard editing access to 2-3 senior administrators only; audit and remove any javascript: URIs from existing dashboards; enable comprehensive logging for dashboard modifications. Within 30 days: Upgrade to Checkmk 2.5.0p5 or later (if on 2.5.x), 2.4.0p31 or later (if on 2.4.x), 2.3.0p48 or later (if on 2.3.x), or upgrade from 2.2.x to 2.3.0p48 or newer since 2.2.x line has no patch available.

EUVD-2026-35061 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-08 Checkmk

GHSA-6f3j-vw42-8645

XSS Checkmk

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 08, 2026 - 14:01 EUVD

Analysis Generated

Jun 08, 2026 - 13:49 vuln.today

CVSS changed

Jun 08, 2026 - 13:22 NVD

8.5 (HIGH)

DescriptionCVE.org

Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions to store a URL with a dangerous URI scheme such as javascript: that executes scripts in other users' browsers when they view the dashboard.

AnalysisAI

Stored cross-site scripting in Checkmk monitoring platform allows a low-privileged user with dashboard editing rights to embed a javascript: URI inside the URL dashboard widget, which then executes in the browser of any other user viewing that dashboard. The flaw affects Checkmk versions prior to 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 releases, and carries a CVSS 4.0 score of 8.5 due to the high confidentiality and integrity impact achievable against higher-privileged operators. No public exploit identified at time of analysis, but the prerequisite (dashboard edit permission) is commonly granted to operations staff.

Technical ContextAI

Checkmk (cpe:2.3:a:checkmk_gmbh:checkmk) is an IT infrastructure monitoring platform that ships with a customizable dashboarding UI. One of the built-in widgets renders a user-supplied URL, but the implementation did not restrict the URI scheme, allowing pseudo-protocols such as javascript:, data:, or vbscript: to be persisted alongside the dashboard configuration. This is a classic instance of CWE-79 (Improper Neutralization of Input During Web Page Generation) realized through unsafe-scheme sinks rather than raw HTML injection - the payload is stored server-side in the dashboard definition and re-rendered, unsanitized, into an href or equivalent attribute when other users open the dashboard, causing the script to execute in their authenticated Checkmk session context.

RemediationAI

Vendor-released patches are available: upgrade to Checkmk 2.5.0p5, 2.4.0p31, or 2.3.0p48 or later, per the Checkmk Werk advisory at https://checkmk.com/werk/17991. The 2.2.0 branch has no fixed release listed and appears end-of-life for this fix, so 2.2.0 operators must migrate to a supported branch. As an interim compensating control, audit Role-Based Access Control to remove dashboard-editing permission from users who do not require it (this reduces who can plant the payload but does not stop a malicious insider who already has the role); operators can also review existing dashboard URL widgets for non-http(s) schemes and remove suspicious entries before patching, since the payload is persisted and would otherwise survive the upgrade.