EUVD-2026-63903
GHSA-8fww-64wc-46pf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no credentials required; impact confined to limited integrity and availability on the relay channel, no confidentiality loss, scope unchanged.
Primary rating from Vendor (checkmk).
CVSS VectorVendor: checkmk
Lifecycle Timeline
2DescriptionCVE.org
Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only the Cloud, Ultimate and Ultimate MT editions are affected, as other editions do not expose relay endpoints.
AnalysisAI
Remote unauthenticated attackers can bypass mutual TLS client certificate verification on relay endpoints in Checkmk versions prior to 2.5.0p10 by supplying a fixed placeholder identity value in the request URL. Exploitation results in limited integrity and availability impact against the agent receiver relay channel, with no confidentiality exposure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to be running Checkmk in the Cloud, Ultimate, or Ultimate MT edition specifically - standard and lower-tier editions do not expose relay endpoints and are entirely unaffected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 correctly reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N) attack with limited integrity and availability impact (VI:L, VA:L) and no confidentiality impact (VC:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Checkmk to version 2.5.0p10 or later, which resolves the improper authentication in the agent receiver relay endpoint as confirmed by the vendor advisory at https://checkmk.com/werk/20174. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today