PT-2026-31898 · Checkmk · Checkmk

Published 2026-04-10 · Updated 2026-04-12 · CVE-2026-33455

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0b4

Description A flaw exists in the monitoring quicksearch functionality of Checkmk that allows an authenticated attacker to inject Livestatus commands through the search query. This is due to insufficient input sanitization within the search filter plugins. The injection occurs via the search query.

Recommendations Update to version 2.5.0b4 or later.

Fix

Weakness Enumeration

CWE-140

Related Identifiers

CVE-2026-33455

Affected Products

Checkmk

References · 7

• https://ubuntu.com/security/CVE-2026-33455 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33455 · Security Note
• https://checkmk.com/werk/17988 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33455 · Security Note
• https://twitter.com/CVEarity/status/2043211793871573172 · Twitter Post
• https://twitter.com/CVEnew/status/2042561716513575255 · Twitter Post