Checkmk CVE-2026-90990

Requires a valid authenticated Checkmk account (PR:L) with access to the monitoring host and service list APIs, and the deployment must rely on contact-group-based object visibility restrictions for the visibility-bypass impact to matter (multi-tenant or role-segmented installs). The attacker supplies a filter value containing a newline character to inject extra Livestatus query headers into count queries. Exploitation is limited by the need for authentication and by the low, bounded impact (count-based inference rather than full data read); single-team installs without contact-group segmentation gain little confidentiality benefit for an attacker, though the worker-exhaustion DoS still applies. Fixed in Checkmk 2.5.0p14.

This is a moderate-risk, authenticated issue rather than a critical priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L = 5.3) requires an already-authenticated Checkmk user (PR:L) but no user interaction and low complexity, so any low-privilege monitoring account can attempt it over the network. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation status is 'no public exploit identified at time of analysis' - the risk is theoretical/opportunistic, not confirmed in-the-wild. The impact is intentionally bounded: the flaw enables an authorization bypass (inferring existence of hosts/services outside the attacker's contact groups via count queries) plus a self-inflicted DoS (occupying web/Livestatus workers for an attacker-controlled duration). All three impact metrics are 'Low', consistent with information inference plus partial resource exhaustion rather than full data disclosure or takeover. Note one signal tension: the vendor sets VI:L (integrity), but the described impact is really visibility bypass and worker exhaustion - integrity impact is marginal and closer to None. Overall: a real hardening defect worth patching promptly for multi-tenant/contact-group-segmented deployments, but not an emergency for single-team installs.

A low-privilege Checkmk user with access to the host/service list APIs submits a filter value containing an embedded newline, injecting an extra Livestatus query header (e.g. a Filter or Stats line) into the backend count query. By observing count results they infer the existence and attributes of hosts and services outside their assigned contact groups, and by crafting expensive injected headers they tie up web-server and Livestatus workers for a chosen duration. No public exploit code is available, but the attack requires only a valid authenticated session and low complexity (AC:L, no UI).