CVE-2025-64998 Overview
CVE-2025-64998 is a session hijacking vulnerability in Checkmk monitoring software caused by the exposure of session signing secrets. The vulnerability exists in Checkmk versions prior to 2.4.0p23, 2.3.0p45, and all versions of 2.2.0. An administrator of a remote site with config sync enabled can exploit this flaw to hijack sessions on the central site by forging session cookies.
This vulnerability is classified under CWE-522 (Insufficiently Protected Credentials), indicating that sensitive authentication material is being exposed in a manner that allows unauthorized access.
Critical Impact
An attacker with administrator privileges on a remote Checkmk site can leverage the exposed session signing secret to forge valid session cookies, enabling complete session hijacking on the central monitoring site.
Affected Products
- Checkmk versions prior to 2.4.0p23
- Checkmk versions prior to 2.3.0p45
- Checkmk 2.2.0 (all versions)
Discovery Timeline
- 2026-03-24 - CVE-2025-64998 published to NVD
- 2026-03-24 - Last updated in NVD database
Technical Details for CVE-2025-64998
Vulnerability Analysis
The vulnerability stems from improper protection of the session signing secret used by Checkmk's authentication mechanism. In distributed Checkmk deployments where configuration synchronization is enabled between remote and central sites, the session signing secret is inadvertently exposed to administrators of remote sites.
Session signing secrets are cryptographic keys used to generate and validate session cookies. When these secrets are shared or exposed, any party with access to them can create valid session tokens for any user, including privileged accounts on the central site. This represents a significant trust boundary violation in multi-site Checkmk deployments.
The attack requires the attacker to have administrator access to a remote Checkmk site and for config sync to be enabled between that site and the central site. While this limits the attack surface to insider threats or compromised remote sites, the impact of successful exploitation is severe.
Root Cause
The root cause is the insufficient protection of session signing credentials during the configuration synchronization process between Checkmk sites. The session signing secret, which should remain isolated to the central site's authentication subsystem, is being transmitted or accessible as part of the sync mechanism. This violates the principle of credential isolation and allows remote site administrators to access sensitive authentication material belonging to the central site.
Attack Vector
The attack is network-based and requires authenticated access with administrative privileges on a remote Checkmk site. The attacker must also rely on configuration sync being enabled in the target deployment. The exploitation flow involves:
- Attacker gains or has administrator access to a remote Checkmk site
- Configuration sync is enabled between the remote and central sites
- Attacker extracts the exposed session signing secret from the synchronized configuration
- Attacker forges a valid session cookie for a privileged user on the central site
- Attacker uses the forged cookie to hijack sessions and gain unauthorized access to the central monitoring site
The vulnerability mechanism involves extracting the session signing secret from synchronized configuration data and using it to craft malicious session cookies. For detailed technical information, refer to the Checkmk Security Update.
Detection Methods for CVE-2025-64998
Indicators of Compromise
- Unusual session activity on the central Checkmk site from IP addresses associated with remote sites
- Multiple concurrent sessions for the same user account originating from different locations
- Session tokens appearing for users who have not recently authenticated
- Anomalous administrative actions performed from unexpected source systems
Detection Strategies
- Monitor authentication logs for session creation events that bypass normal login workflows
- Implement alerting on administrative sessions originating from remote site infrastructure
- Audit configuration sync logs for unauthorized access patterns
- Deploy session anomaly detection to identify forged or cloned session cookies
Monitoring Recommendations
- Enable detailed logging for all Checkmk authentication and session management events
- Configure SIEM rules to correlate session activity with authentication events
- Implement network segmentation monitoring between Checkmk sites
- Establish baseline session behavior patterns for privileged accounts to detect anomalies
How to Mitigate CVE-2025-64998
Immediate Actions Required
- Upgrade Checkmk to version 2.4.0p23 or later (for 2.4.x branch)
- Upgrade Checkmk to version 2.3.0p45 or later (for 2.3.x branch)
- For Checkmk 2.2.0 users, migrate to a supported version as 2.2.0 is affected in all releases
- Rotate all session signing secrets after applying the patch
- Review and restrict config sync configurations to minimize trust relationships
Patch Information
Checkmk has released security patches addressing this vulnerability. Users should upgrade to the following versions or later:
- Checkmk 2.4.0p23 for the 2.4.x branch
- Checkmk 2.3.0p45 for the 2.3.x branch
For complete patch details and upgrade instructions, see the Checkmk Security Update.
Workarounds
- Temporarily disable configuration synchronization between remote and central sites until patches can be applied
- Implement network-level access controls to restrict communication between Checkmk sites
- Increase session validation requirements and reduce session token validity periods
- Monitor for suspicious session activity and force re-authentication for sensitive operations
- Consider isolating the central Checkmk site from direct remote site administrative access
# Example: Verify Checkmk version after upgrade
omd version
# Ensure output shows 2.4.0p23+ or 2.3.0p45+ depending on your branch
# Review active sessions and force logout if suspicious activity detected
omd su <site_name>
cmk --automation logout-all-users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
