PT-2026-29251 · Checkmk · Checkmk

Published 2026-03-31 · Updated 2026-04-02 · CVE-2026-20915

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0b2

Description A stored cross-site scripting issue exists in Checkmk. Authenticated users with permission to create pending changes can inject malicious JavaScript into the Pending Changes sidebar. This injected script will then execute in the browsers of other users who view the sidebar. The vulnerable component is the Pending Changes sidebar.

Recommendations Update to version 2.5.0b2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-20915

Affected Products

Checkmk

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-20915 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-20915 · Security Note
• https://checkmk.com/werk/19526 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-20915 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-20915 · Vendor Advisory
• https://twitter.com/CVEnew/status/2039004451646611745 · Twitter Post