EUVD-2026-63321
GHSA-c84g-3xmv-j872
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with restricted Checkmk account
-
ExploitNavigate to or query frozen BI aggregation
-
ExecutionAuthorization check bypassed for frozen state
-
ImpactRead names and existence of out-of-scope hosts/services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) a valid Checkmk account with at least low-privilege access (PR:L confirmed by CVSS vector), (2) the Checkmk installation must have the BI module configured with frozen aggregations enabled and in use (AT:P - attack requirement present; this is a non-default feature state requiring deliberate configuration), and (3) the attacker's account must have restricted host/service visibility configured via Checkmk's role and permission system - the vulnerability only manifests in multi-tenancy or compartmentalized deployments. Exploitation is limited to metadata disclosure (host and service names and existence only); actual monitoring data, credentials, or configuration are not exposed. Unauthenticated access is not possible. |
| Impact | Real-world risk is low. The CVSS 4.0 score of 2.3 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N) reflects network accessibility and low privilege requirements but is constrained by AT:P (attack requirements present - frozen BI aggregations must be configured and in use) and a confidentiality impact limited to metadata only (names and existence, not monitoring data or credentials). EPSS data is not provided. There is no CISA KEV listing and no public exploit code identified. SSVC signals align with a 'track' disposition: exploitation requires authentication and a non-default feature state, technical impact is partial (information disclosure only), and no automatable mass-exploitation path is evident. The primary risk is to environments with strict multi-tenancy or compartmentalized visibility requirements - where leaking host and service names constitutes a meaningful security boundary violation. |
| Exploit ScenarioDerived | An authenticated Checkmk user whose role restricts visibility to a subset of hosts and services - such as a contractor or a team member with scoped access - queries frozen BI aggregation views through the Checkmk web interface or API. The authorization check fails to enforce the user's scope filter on the frozen aggregation data, revealing the names and existence of hosts and services the user is not permitted to see. No public exploit code exists for this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Incorrect authorization in Checkmk's frozen BI (Business Intelligence) aggregation feature exposes host and service names to authenticated users whose visibility should be restricted. Specifically, users with intentionally scoped permissions can infer the existence and names of hosts and services outside their authorized scope by querying frozen BI aggregations. Affects all 2.2.0 versions and versions prior to 2.3.0p47, 2.4.0p29, and 2.5.0p2. No public exploit code exists and no active exploitation is confirmed; CVSS 4.0 score of 2.3 reflects the constrained, low-impact nature of this information disclosure.
RemediationAI
Upgrade Checkmk to 2.3.0p47, 2.4.0p29, or 2.5.0p2 or later, depending on the deployed release branch, as documented in the vendor advisory at https://checkmk.com/werk/16917. For installations on the 2.2.0 branch, no patch is available; operators should consider upgrading to a supported branch. As a compensating control prior to patching, administrators can disable or avoid use of the frozen BI aggregation feature - disabling it removes the vulnerable code path entirely, with the trade-off that pre-computed BI aggregations will no longer be available and real-time aggregation performance may be affected. Additionally, auditing user role assignments to minimize the population of users with any BI aggregation access reduces exposure to the information leakage.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Checkmk is an enterprise IT monitoring platform built on top of Nagios/CMK. Its Business Intelligence (BI) module aggregates monitoring states across hosts and services into logical hierarchies. The 'frozen' aggregation mode pre-computes and caches these hierarchical views. CWE-863 (Incorrect Authorization) indicates that the authorization check applied to BI aggregation queries does not properly enforce the host/service visibility scope assigned to a user's role. As a result, the frozen state reveals metadata - specifically names and existence - of objects outside the user's permitted scope. The affected CPE is cpe:2.3:a:checkmk_gmbh:checkmk:*:*:*:*:*:*:*:*, spanning multiple major release branches.
Know when Checkmk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
AC:H reflects the AT:P prerequisite (frozen BI aggregations must be configured); PR:L for authenticated access; confidentiality only, limited to metadata.
Primary rating from Vendor (Checkmk).
CVSS VectorVendor: Checkmk
Lifecycle Timeline
1DescriptionCVE.org
Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, whi
The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dok
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uplo
Local privilege escalation in the Checkmk Windows Agent's Windows License plugin allows an authenticated low-privileged
Stored/transmitted cross-site scripting in Checkmk's distributed monitoring lets an attacker who already controls a remo
Authenticated path traversal in Checkmk's report scheduler lets a user with valid application credentials write report f
Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta
The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the W
Local privilege escalation in Checkmk allows site users with high privileges to escalate to root by manipulating site co
Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass
Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrar
Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8
Exploit-DB