PT-2026-25169 · Checkmk Gmbh+3 · Checkmk

Michał Krawczyk + 1 · Publicado 2026-03-13 · Atualizado 2026-03-13 · CVE-2026-2859

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Checkmk versions 2.4.0 through 2.4.0p22 Checkmk versions 2.3.0 through 2.3.0p42 Checkmk version 2.2.0

Description Improper permission enforcement allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in the deploy agent API endpoint, potentially leading to information disclosure.

Recommendations Update Checkmk to version 2.4.0p23 or later. Update Checkmk to version 2.3.0p43 or later. Checkmk version 2.2.0 is end-of-life and should be upgraded to a supported version.

Correção

Enumeração de Fraquezas

CWE-204

Identificadores relacionados

CVE-2026-2859

Produtos afetados

Checkmk

Referências · 8

• https://t.me/CVEtracker/47335 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2859 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-2859 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-2859 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-2859 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-2859 · Nota de Segurança
• https://twitter.com/CVEnew/status/2032410919838605641 · Publicação no Twitter
• https://checkmk.com/werk/18994 · Aviso do Fabricante