PT-2026-30816 · Checkmk · Checkmk

Alex Williams · CVE-2026-3466 · Published 2026-04-07 · Updated 2026-04-19

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Checkmk versions 2.2.0 (EOL), 2.3.0 through 2.3.0p45, 2.4.0 through 2.4.0p24, and 2.5.0 (beta) through 2.5.0b2

Description Insufficient sanitization of dashboard dashlet title links allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks. An attacker can trick a victim into clicking a crafted dashlet title link on a shared dashboard.

Recommendations Update to Checkmk version 2.3.0p46 or later. Update to Checkmk version 2.4.0p25 or later. Update to Checkmk version 2.5.0b3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3466

Affected Products

Checkmk

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3466.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3466 · Security Note
• https://ubuntu.com/security/CVE-2026-3466 · Vendor Advisory
• https://checkmk.com/werk/19583 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3466 · Vendor Advisory
• https://checkmk.com/werk/19033 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3466 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3466 · Vendor Advisory
• https://t.me/cveNotify/158432 · Telegram Post
• https://vulncheck.com/advisories/checkmk-stored-cross-site-scripting-in-dashlet-title · Note
• https://twitter.com/CVEnew/status/2045972456289206517 · Twitter Post