Checkmk EUVD-2026-17867

This vulnerability presents moderate real-world risk despite a CVSS score of 5.3. The CVSS vector (AV:N/AC:L/PR:L) confirms network accessibility and requires low-privilege authentication, but does not require user interaction and has low attack complexity. The impact scope is limited: confidentiality and integrity are reduced (VC:L/VI:L), and availability is not affected (VA:L/SA:N). SSVC factors favor patching: exploitation requires only low-privilege account access (common in managed monitoring environments), the impact is technically bounded but enables horizontal privilege escalation within the platform, and patches are readily available. The vulnerability is not listed as actively exploited (no KEV confirmation), but the straightforward attack vector (low-complexity network request from authenticated user) and clear permission validation flaw make this a practical exploit scenario. Organizations with diverse user roles in Checkmk should prioritize patching to prevent unauthorized configuration changes or information disclosure by standard users.

A standard monitoring team member with read-only user privileges authenticates to Checkmk and sends HTTP requests to Quick Setup REST API endpoints that lack proper authorization checks. The attacker retrieves sensitive configuration data (such as notification settings, authentication mechanisms, or system topology) or performs unauthorized configuration changes (such as adding users or modifying alert rules) without elevated privileges. No special complexity or user interaction is required; the attack succeeds due to missing authorization validation on the endpoint handlers.