PT-2026-25169 · Checkmk Gmbh+3 · Checkmk

Michał Krawczyk + 1 · Published 2026-03-13 · Updated 2026-03-13 · CVE-2026-2859

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Checkmk versions 2.4.0 through 2.4.0p22 Checkmk versions 2.3.0 through 2.3.0p42 Checkmk version 2.2.0

Description Improper permission enforcement allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in the deploy agent API endpoint, potentially leading to information disclosure.

Recommendations Update Checkmk to version 2.4.0p23 or later. Update Checkmk to version 2.3.0p43 or later. Checkmk version 2.2.0 is end-of-life and should be upgraded to a supported version.

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2026-2859

Affected Products

Checkmk

References · 8

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2859 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2859 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2859 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-2859 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2859 · Security Note
• https://checkmk.com/werk/18994 · Vendor Advisory
• https://t.me/CVEtracker/47335 · Telegram Post
• https://twitter.com/CVEnew/status/2032410919838605641 · Twitter Post