Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-17548: Checkmk users can view other users' job results
CVE-2026-17548 · published 2 months ago
Summary
In certain versions of Checkmk, a logged‑in user who knows a job’s identifier can see the status and output of that background job, even if it belongs to someone else. This could expose sensitive monitoring data. Upgrade to the latest Checkmk release or apply the vendor’s patch to close the gap.
What to do
- Update checkmk gmbh checkmk to version 2.5.0p12 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | checkmk gmbh | checkmk | < 2.5.0p12 |
| Ubuntu:Pro:16.04:LTS | canonical | check-mk | All versions |
| Ubuntu:18.04:LTS | canonical | check-mk | All versions |
Original advisory text
Missing authorization in Checkmk <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results.
Missing authorization in Checkmk <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results.
References
- https://checkmk.com/werk/22115
- https://ubuntu.com/security/CVE-2026-17548 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-17548 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published25 Aug 2026
Updated4 Nov 2026
First seen25 Aug 2026
Track software like this
Free during beta