Checkmk EUVD-2026-21342

The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates a relatively contained vulnerability: network-accessible, low complexity, but requiring low-privilege authentication (PR:L), with low impact across confidentiality, integrity, and availability. The absence of an EPSS score and lack of KEV/active exploitation status suggest this is not a high-priority threat in real-world environments despite the network vector. However, the low bar for authentication (any valid Checkmk user) and the possibility of lateral movement within a monitoring infrastructure warrant timely patching, particularly in environments where monitoring access is broadly distributed. The code injection classification (CWE-140) confirms the technical severity but does not translate to critical real-world risk given the authentication requirement and constrained impact scope.

A low-privilege Checkmk user (e.g., a help desk staff member with read-only monitoring access) uses the quicksearch feature and injects a malicious Livestatus filter such as 'GET hosts|Filter: ...' injected into the search box to bypass intended output filtering or retrieve sensitive host configuration data not normally visible to their role. Because the attack requires valid authentication and does not escalate privileges beyond the attacker's existing role, the impact is confined to information disclosure or minor manipulation of monitoring views rather than system compromise. No public proof-of-concept or active exploitation has been identified.