PT-2026-25168 · Checkmk Gmbh+3 · Checkmk

Michał Kaczmarek · Published 2026-03-13 · Updated 2026-03-13 · CVE-2026-24097

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Checkmk versions 2.4.0 through 2.4.0p23 Checkmk versions 2.3.0 through 2.3.0p43 Checkmk version 2.2.0

Description Improper permission enforcement allows authenticated users to enumerate existing hosts by observing different HTTP response codes in the /agent-receiver/register existing API endpoint, potentially leading to information disclosure.

Recommendations Checkmk versions 2.4.0 through 2.4.0p23 should be updated to version 2.4.0p23 or later. Checkmk versions 2.3.0 through 2.3.0p43 should be updated to version 2.3.0p43 or later. Checkmk version 2.2.0 is end-of-life and should be upgraded to a supported version.

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2026-24097

Affected Products

Checkmk

References · 8

• https://cve.org/CVERecord?id=CVE-2026-24097 · Security Note
• https://ubuntu.com/security/CVE-2026-24097 · Vendor Advisory
• https://checkmk.com/werk/18993 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24097 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24097 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24097 · Vendor Advisory
• https://t.me/CVEtracker/47334 · Telegram Post
• https://twitter.com/CVEnew/status/2032410920874627360 · Twitter Post