CVE-2026-17548: Checkmk Authorization Bypass Vulnerability

CVE-2026-17548 Overview

CVE-2026-17548 is a missing authorization vulnerability in Checkmk, an IT infrastructure monitoring platform. The flaw allows an authenticated user who knows the identifier of a background job to view that job's status and results without proper authorization checks. The vulnerability is tracked as CWE-862: Missing Authorization.

Affected versions include Checkmk before 2.5.0p12, before 2.4.0p36, before 2.3.0p50, and all 2.2.0 releases. The issue requires low-privileged authenticated access and no user interaction.

Critical Impact
Authenticated users can enumerate and view background job status and results belonging to other users, exposing potentially sensitive monitoring output and operational data.

Affected Products

Checkmk versions prior to 2.5.0p12
Checkmk versions prior to 2.4.0p36 and 2.3.0p50
All Checkmk 2.2.0 versions

Discovery Timeline

2026-08-25 - CVE-2026-17548 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-17548

Vulnerability Analysis

Checkmk exposes background jobs through its web interface to handle long-running tasks such as service discovery, bulk operations, and report generation. Each job is assigned an identifier used to query status and retrieve results.

The application fails to verify that the requesting user is authorized to view the requested background job. Any authenticated user who obtains or guesses a valid job identifier can retrieve the job's status and output, bypassing intended access boundaries.

The issue is limited to confidentiality of background job data. It does not permit modification of jobs or impact on system availability, according to the CVSS vector. See the Checkmk Patch Announcement for vendor details.

Root Cause

The root cause is a missing authorization check on the code paths that expose background job status and results. The application authenticates the session but does not enforce ownership or role-based access on the job identifier supplied by the client.

Attack Vector

Exploitation requires network access to the Checkmk web interface and valid credentials for any account. An attacker enumerates or guesses background job identifiers and issues requests to the endpoints that return job status and output. The server returns the requested data without validating that the caller owns the job or holds the required role.

No verified public proof-of-concept is available. The vulnerability manifests in the background job handler; refer to the vendor werk entry for technical specifics.

Detection Methods for CVE-2026-17548

Indicators of Compromise

Authenticated web requests from a single user session enumerating sequential or high-volume background job identifiers.
Access to background job endpoints by user accounts that did not initiate the corresponding jobs.
Unusual response sizes returned from background job status endpoints correlated with reconnaissance activity.

Detection Strategies

Review Checkmk web access logs for repeated requests to background job endpoints from the same session within short time windows.
Correlate job creation events with job read events and flag mismatches between the creating user and the reading user.
Alert on low-privilege accounts issuing large numbers of authenticated GET requests to internal administrative paths.

Monitoring Recommendations

Forward Checkmk apache and application logs to a central log platform and retain them for post-incident review.
Baseline normal per-user background job activity and alert on statistical deviations.
Monitor authentication events for accounts exhibiting reconnaissance patterns following successful login.

How to Mitigate CVE-2026-17548

Immediate Actions Required

Upgrade Checkmk to 2.5.0p12, 2.4.0p36, 2.3.0p50, or later as documented in the vendor advisory.
Retire all 2.2.0 deployments; the 2.2.0 branch is affected and no fixed release is provided in that line.
Rotate credentials for any low-privilege Checkmk accounts if unauthorized access is suspected.
Review recent background job activity for cross-user access attempts.

Patch Information

Checkmk has released fixed builds in the 2.5.0p12, 2.4.0p36, and 2.3.0p50 maintenance releases. See the Checkmk Patch Announcement (werk 22115) for release notes and upgrade guidance.

Workarounds

Restrict network access to the Checkmk web interface to trusted administrative networks using firewall rules or reverse proxy access control lists.
Reduce the number of authenticated user accounts and enforce least privilege for operator roles until patches are applied.
Enable multi-factor authentication on the Checkmk web interface to raise the barrier for account compromise.

bash

# Example: verify installed Checkmk version on a monitoring server
omd version
# Upgrade an existing site to a patched release (adjust site name and version)
omd stop mysite
omd update mysite
omd start mysite