EUVD-2026-84349
GHSA-xwvr-5xw4-qv5w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Checkmk REST API as low-priv user
-
ExploitGET host/folder configuration endpoint
-
ExecutionRead cleartext SNMP/SNMPv3/IPMI credentials from response
-
ImpactReuse harvested credentials against monitored devices
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
|
| Exploitation Conditions | Requires an authenticated Checkmk account (PR:L) whose permissions include viewing the target host's configuration, plus network reachability to the REST API host/folder configuration endpoints. Exploitation only yields value when SNMP community strings, SNMPv3 auth/privacy passphrases, or IPMI passwords have actually been configured and stored on hosts. It is limited by needing a valid account with host-config view rights - it is not exploitable by an anonymous/unauthenticated attacker - and affects Checkmk versions below 2.5.0p15, 2.4.0p37, 2.3.0p51, and the EOL 2.2.0 line. |
| Impact | This is a genuinely low-priority issue and the available signals are internally consistent. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N with subsequent-system SC:L/SI:L/SA:L) scores only 2.3, reflecting an authenticated (PR:L), network-reachable information leak with no integrity or availability impact on Checkmk itself. There is no EPSS score, no CISA KEV listing, and no public POC in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The only meaningful risk is downstream: the leaked values are SNMP community strings, SNMPv3 auth/privacy passphrases, and IPMI passwords, so a low-privileged monitoring operator can harvest credentials that grant access to the monitored network devices and out-of-band management interfaces - this is precisely why the vendor assigned subsequent-system impact (SC/SI/SA:L). No data is missing or conflicting: the CWE-522 (Insufficiently Protected Credentials) classification, the description, and the CVSS vector all agree. The one nuance worth noting is that the disclosure crosses a trust boundary into managed devices, which arguably warrants a scope change (S:C) in CVSS 3.1 terms even though the direct impact on Checkmk is minimal. |
| Exploit ScenarioDerived | A low-privileged Checkmk user who has been granted permission to view a host's configuration issues an authenticated GET request to the REST API host or folder configuration endpoints. The JSON response returns SNMP community strings, SNMPv3 auth/privacy passphrases, and IPMI passwords in clear text - values the setup GUI deliberately hides - which the operator can then reuse to access or reconfigure the monitored network and management devices. No public exploit code is identified, and no special tooling is needed beyond a valid session and API access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Checkmk's REST API discloses stored monitoring credentials - SNMP community strings, SNMPv3 authentication and privacy passphrases, and IPMI passwords - in cleartext inside GET responses from the host and folder configuration endpoints, even though the setup GUI never renders those secrets. The defect affects Checkmk installations below 2.5.0p15, below 2.4.0p37, below 2.3.0p51, and the end-of-life 2.2.0 line, and is reachable only by an authenticated user (CVSS vector PR:L) whose role permits viewing a target host's configuration; an anonymous or unauthenticated attacker cannot trigger it. Scoring is low (vendor CVSS 4.0 base 2.3; independent CVSS 3.1 assessment AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), and no public exploit code or CISA KEV entry was identified at time of analysis, so the real-world risk is driven mainly by whether valuable SNMP or IPMI secrets have actually been configured on monitored hosts and by how broadly host-config view rights are granted.
RemediationAI
Vendor-released patch: upgrade to Checkmk 2.5.0p15, 2.4.0p37, or 2.3.0p51 (or a later release on a supported line) as described in Checkmk Werk 20077 (https://checkmk.com/werk/20077); the 2.2.0 branch is end-of-life and has no fix, so those installations must migrate to a supported release. Because the leaked values may already have been retrieved by any account that could view host configurations, treat the secrets as potentially disclosed: rotate all SNMP community strings, SNMPv3 authentication and privacy passphrases, and IPMI passwords stored in Checkmk, and update them both on the monitored devices and in Checkmk - note that rotation causes a brief window of monitoring failures until both sides match. As compensating controls until patching completes, restrict network access to the Checkmk REST API host and folder endpoints to trusted management networks or a reverse proxy that enforces authentication and source-IP allowlisting (this breaks legitimate remote API integrations and automation callers that originate outside those networks), and audit and reduce the set of users and automation accounts holding host-configuration view rights via the role and contact-group model, since the flaw is only exploitable by an authenticated principal with those rights. If the API is not needed operationally, disabling or firewalling it entirely removes the exposure at the cost of losing programmatic configuration management.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-522 (Insufficiently Protected Credentials): Checkmk stores credentials it needs to poll monitored devices - SNMP v1/v2c community strings, SNMPv3 USM authentication and privacy passphrases, and IPMI/BMC passwords - as part of each host's and folder's configuration, but its REST API host and folder configuration endpoints serialize those fields back to the caller without masking. The setup GUI applies output filtering that hides these values, so the exposure is API-specific and easy to miss during manual review. The affected component is the Checkmk REST API of the Checkmk server product (CPE cpe:2.3:a:checkmk_gmbh:checkmk:*:*:*:*:*:*:*:*), meaning all tracked versions are in scope for evaluation until the fixed maintenance releases are applied. The independent assessment scores the issue with S:C (scope change) because a user granted only host-configuration read access can obtain secrets that are subsequently usable against separate systems - the managed network devices - which is a crossing of security boundaries even though confidentiality impact on Checkmk itself is rated Low (C:L) and integrity/availability impact is None. There is no path to code execution, data modification, or denial of service; the vulnerability is purely a credential-disclosure weakness whose blast radius equals the value of the stored device secrets and the reuse of those secrets elsewhere.
Know when Checkmk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L
Authenticated low-priv API read (PR:L, AC:L) leaking stored credentials; S:C because exposed SNMP/IPMI secrets impact separate managed devices; confidentiality-only, low.
Primary rating from Vendor (Checkmk).
CVSS VectorVendor: Checkmk
Lifecycle Timeline
3DescriptionCVE.org
Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk <2.5.0p15, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases and IPMI passwords in clear text from GET responses, although the setup GUI never displays these values.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, whi
The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dok
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uplo
Local privilege escalation in the Checkmk Windows Agent's Windows License plugin allows an authenticated low-privileged
Stored/transmitted cross-site scripting in Checkmk's distributed monitoring lets an attacker who already controls a remo
Authenticated path traversal in Checkmk's report scheduler lets a user with valid application credentials write report f
Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta
The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the W
Local privilege escalation in Checkmk allows site users with high privileges to escalate to root by manipulating site co
Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass
Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrar
Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8
Exploit-DB