Is there a patch available for EUVD-2026-21346?

Yes, a patch is available for EUVD-2026-21346. Update the affected software to the latest version immediately.

Checkmk EUVD-2026-21346

Q: What is the CVSS score of EUVD-2026-21346?

EUVD-2026-21346 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: Which versions of Checkmk are affected by EUVD-2026-21346?

Livestatus command injection in Checkmk prediction graph page allows authenticated users to execute arbitrary Livestatus commands by injecting malicious service name parameters due to insufficient…. A patch is available.

| CVE-2026-33457 MEDIUM

Improper Neutralization of Delimiters (CWE-140)

2026-04-10 Checkmk

GHSA-8gxr-c98h-cwxm

Code Injection Checkmk

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2.4.0p26,2.3.0p47,2.5.0b4

EUVD ID Assigned

Apr 10, 2026 - 08:45 euvd

EUVD-2026-21346

Analysis Generated

Apr 10, 2026 - 08:45 vuln.today

CVE Published

Apr 10, 2026 - 08:31 nvd

MEDIUM 5.3

DescriptionCVE.org

Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value.

AnalysisAI

Livestatus command injection in Checkmk prediction graph page allows authenticated users to execute arbitrary Livestatus commands by injecting malicious service name parameters due to insufficient input sanitization. Affected versions include Checkmk 2.3.0 before p47, 2.4.0 before p26, and 2.5.0 before b4. The vulnerability requires valid authentication credentials to exploit and results in limited confidentiality, integrity, and availability impact within the Livestatus subsystem.

Technical ContextAI

Checkmk's prediction graph page processes service description values that are passed to Livestatus, the monitoring system's query interface. The vulnerability stems from CWE-140 (Improper Neutralization of Delimiters), where user-controlled service name parameters are not properly sanitized before being incorporated into Livestatus command syntax. This allows an authenticated attacker to inject arbitrary Livestatus protocol commands by crafting malicious service names that break out of the intended command context. Livestatus is Checkmk's internal query language used for real-time monitoring data access, and injection at this layer can permit unauthorized data access or manipulation within the monitoring infrastructure.

RemediationAI

Upgrade Checkmk to patched versions: 2.3.0p47 or later, 2.4.0p26 or later, or 2.5.0b4 or later, depending on your current branch. These releases include proper sanitization of service name parameters before they are processed by Livestatus. Consult the official Checkmk advisory at https://checkmk.com/werk/17990 and the NVD detail page at https://nvd.nist.gov/vuln/detail/CVE-2026-33457 for download links and installation instructions. Organizations unable to patch immediately should restrict Checkmk user access to trusted personnel only and monitor Livestatus logs for unusual command patterns.