CVE-2026-14452 Overview
CVE-2026-14452 is an open redirect and script execution vulnerability in Checkmk's Setup in-page search functionality. The flaw stems from improper validation of the reset_url parameter, classified as [CWE-601] URL Redirection to Untrusted Site. An attacker who tricks an authenticated Setup user into opening a crafted URL and clicking the Reset button, or submitting an empty search, can execute arbitrary script in that user's session or redirect the user to an attacker-controlled site. The vulnerability affects Checkmk versions prior to 2.5.0p15, 2.4.0p38, 2.3.0p51, and the end-of-life 2.2.0 branch.
Critical Impact
Attackers can hijack authenticated Checkmk Setup sessions through social engineering, leading to arbitrary script execution and credential or configuration compromise.
Affected Products
- Checkmk versions prior to 2.5.0p15
- Checkmk versions prior to 2.4.0p38 and 2.3.0p51
- Checkmk 2.2.0 (End of Life)
Discovery Timeline
- 2026-10-16 - CVE-2026-14452 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-14452
Vulnerability Analysis
The vulnerability resides in the Setup in-page search feature of Checkmk. The reset_url parameter accepts user-controlled input without sufficient validation. When an authenticated Setup user clicks the Reset button or submits an empty search query, the application processes the parameter as a destination URL.
Because the parameter can carry attacker-chosen values, it supports two exploitation outcomes. The first is open redirection to an arbitrary external site, enabling phishing against authenticated administrators. The second is injection of script content that executes within the user's Setup session.
Setup access in Checkmk grants broad configuration privileges. Script execution in that context can read or modify monitoring configuration, extract session tokens, and pivot to further administrative actions.
Root Cause
The root cause is missing allow-list validation on the reset_url parameter. The Setup in-page search handler trusts the parameter contents instead of restricting it to known internal paths or verifying the URL scheme and origin. This permits both external redirects and javascript:-style URL contexts that result in script execution.
Attack Vector
Exploitation requires user interaction. The attacker crafts a URL targeting the Setup in-page search endpoint with a malicious reset_url value and delivers it through phishing, chat, or a watering-hole link. The victim must already be authenticated to Checkmk with Setup access. Clicking Reset or submitting an empty search triggers the redirect or script execution. For technical specifics, see Checkmk Work Item #22314.
Detection Methods for CVE-2026-14452
Indicators of Compromise
- HTTP requests to Checkmk Setup search endpoints containing suspicious reset_url query parameter values pointing to external domains or non-standard URL schemes.
- Browser referrer logs showing Checkmk administrators landing on unknown external sites immediately after Setup activity.
- Unexpected configuration changes in Checkmk performed from an administrator session shortly after email or chat link clicks.
Detection Strategies
- Inspect web proxy and reverse proxy logs for Checkmk URLs that include reset_url parameters with absolute URLs or encoded script payloads.
- Alert on outbound redirects from the Checkmk host to domains not on an internal allow-list.
- Correlate authenticated Setup user activity with concurrent requests to unfamiliar external resources.
Monitoring Recommendations
- Enable verbose request logging on the Checkmk web server and retain logs for forensic review.
- Monitor browser console errors or Content Security Policy violations originating from Checkmk pages.
- Audit Checkmk Setup user actions and configuration changes on a recurring schedule.
How to Mitigate CVE-2026-14452
Immediate Actions Required
- Upgrade Checkmk to 2.5.0p15, 2.4.0p38, or 2.3.0p51 or later as applicable to your branch.
- Migrate off Checkmk 2.2.0, which is end of life and will not receive this fix.
- Instruct Setup users to avoid clicking Checkmk links received from untrusted sources until patching is complete.
Patch Information
Checkmk released fixes in versions 2.5.0p15, 2.4.0p38, and 2.3.0p51. Full remediation details are documented in Checkmk Work Item #22314. Administrators running the 2.2.0 branch must upgrade to a supported release.
Workarounds
- Restrict access to the Checkmk Setup interface using network segmentation or a VPN to limit exposure to untrusted URL delivery.
- Enforce a strict Content Security Policy at an upstream reverse proxy to block inline script execution and unexpected redirects.
- Reduce the number of accounts with Setup privileges to shrink the attack surface for social-engineering attempts.
# Example: upgrade a Checkmk site to a patched version
omd stop mysite
omd update mysite
omd start mysite
omd version mysite
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
