Checkmk EUVD-2026-17429

Requires authenticated user account in Checkmk 2.5.0 beta (before 2.5.0b2) with permission to create hosts or services. Victim must perform search in Unified Search feature where attacker's malicious payload is stored. Remote exploitation; victim interaction required.

Despite the absence of a CVSS vector score, this vulnerability presents moderate real-world risk in environments where Checkmk is used for critical infrastructure monitoring. The attack requires authentication and specific permissions (ability to create hosts or services), which limits exposure to trusted or compromised internal accounts. However, the stored nature of the XSS significantly increases impact compared to reflected variants-any subsequent user performing searches is at risk without requiring the attacker to socially engineer individual targets. The vulnerability affects only beta version 2.5.0 before 2.5.0b2, limiting the affected user base to early adopters; stable release versions do not appear affected. The absence of CVSS vector data and no indication of EPSS or CISA KEV status suggests this is a lower-severity finding than typical high-CVSS vulnerabilities, though stored XSS in monitoring systems warrants priority patching because operators often interact with monitoring dashboards from shared or less-protected networks.

An authenticated user with permission to create hosts (a common role for infrastructure engineers in monitoring environments) injects a malicious JavaScript payload into a host name or description field. When another engineer performs a search for hosts using the Unified Search feature, the payload is retrieved from the database and executed in their browser with their authentication cookies intact. The attacker's script could steal the engineer's session token, modify monitoring rules to suppress critical alerts, or redirect the user to a phishing page to capture administrative credentials. This attack is particularly dangerous in Checkmk environments because monitoring system access is often compartmentalized and valuable targets (e.g., site administrators) may not expect social engineering from the monitoring platform itself.