Checkmate CVE-2026-71862

Exploitation requires that the Checkmate administrator has enabled the global showURL setting; deployments where showURL is disabled are not affected because the status-page endpoint does not expose monitor data in that configuration. Once showURL is enabled, exploitation imposes no further conditions: the GET /api/v1/status-page/:url endpoint is unauthenticated (PR:N per CVSS vector), reachable over the network without any prior session, and requires no user interaction. Exploitation is limited to Checkmate versions 3.3.0-3.9.1; v3.9.2 and later are patched. There is no platform-specific restriction - any OS or deployment mode running affected versions with showURL enabled is vulnerable. The upstream impact is further conditioned on monitored services actually using the stored HTTP Authorization secrets for authentication, but that is a very common configuration for Checkmate's HttpProvider monitors.

The NVD CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the severity once the prerequisite configuration is in place: any unauthenticated internet user can issue a single HTTP GET and receive authorization credentials. The conditionality - showURL must be globally enabled - introduces a realistic AC:L rather than making this universally exploitable against all Checkmate deployments, because administrators who have not enabled this feature are unaffected. EPSS data was not provided in this intelligence package; the absence of a KEV listing and the niche deployment footprint of Checkmate suggest exploitation is not yet widespread, though the trivial exploitation path means any exposed instance should be treated as immediately at risk. No SSVC decision-framework signals were provided, but the combination of network-accessible vector, zero authentication requirement, and high-value credential output (which can enable lateral movement into monitored services) raises the functional priority well above a typical information-disclosure finding. The secondary impact is potentially severe: the leaked secret is not merely an app credential but an Authorization header value used to authenticate Checkmate against third-party monitored services, meaning exploitation could chain into those downstream systems.

An attacker identifies a publicly reachable Checkmate status page by scanning for the characteristic endpoint path /api/v1/status-page/ or by discovering the instance through OSINT. They issue a simple unauthenticated GET request to /api/v1/status-page/:url and parse the JSON response, extracting the secret field from one or more monitor objects. The attacker then replays that credential as an HTTP Authorization header against the monitored upstream services - internal APIs, dashboards, or infrastructure endpoints - to gain authenticated access to those systems.