CVE-2026-20915: Checkmk Stored XSS Vulnerability

CVE-2026-20915 Overview

A stored cross-site scripting (XSS) vulnerability has been identified in Checkmk version 2.5.0 (beta) before 2.5.0b2. This vulnerability allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar. This represents a significant security risk as it enables attackers to potentially steal session cookies, perform actions on behalf of other users, or exfiltrate sensitive monitoring data.

Critical Impact

Authenticated attackers can inject persistent malicious JavaScript that executes in the context of other administrative users viewing the Pending Changes sidebar, potentially leading to session hijacking, privilege escalation, or data theft within the Checkmk monitoring infrastructure.

Affected Products

• Checkmk version 2.5.0b1 (beta)
• Checkmk version 2.5.0 (beta) prior to 2.5.0b2

Discovery Timeline

• 2026-03-31 - CVE-2026-20915 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-20915

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) resides in the Pending Changes sidebar component of Checkmk's web interface. The vulnerability occurs because user-supplied input used to describe pending changes is not properly sanitized before being rendered in the browser. When a user with appropriate permissions creates a pending change, malicious JavaScript payload embedded in the change description is stored server-side and subsequently executed in the browsers of all users who view the Pending Changes sidebar.

The attack requires network access and authenticated privileges to create pending changes, but once injected, the malicious payload persists and affects any user viewing the sidebar. This includes administrators and other privileged users who may have elevated access within the Checkmk environment.

Root Cause

The root cause is improper input validation and output encoding in the Pending Changes functionality. When user-controlled data is rendered in the sidebar, the application fails to properly sanitize or escape HTML special characters, allowing attackers to inject arbitrary HTML and JavaScript code. This is a classic stored XSS scenario where the malicious payload is persisted in the application's data store and served to multiple victims.

Attack Vector

The attack vector is network-based, requiring an authenticated attacker with permissions to create pending changes. The attacker crafts a malicious pending change entry containing JavaScript code. When other authenticated users—particularly administrators—view the Pending Changes sidebar as part of their normal workflow, the injected script executes in their browser context.

The malicious script then has access to the victim's session, cookies, and can perform any action the victim is authorized to perform within Checkmk. This could include modifying monitoring configurations, accessing sensitive host and service data, or creating backdoor accounts for persistent access.

Detection Methods for CVE-2026-20915

Indicators of Compromise

• Unusual or suspicious content in pending change descriptions containing script tags, event handlers (e.g., onerror, onload), or encoded JavaScript
• Unexpected pending changes created by users who do not typically perform such actions
• Browser console errors or unexpected network requests when viewing the Pending Changes sidebar
• Anomalous session activity or authentication events following sidebar access

Detection Strategies

• Implement web application firewall (WAF) rules to detect common XSS payloads in HTTP requests to Checkmk endpoints
• Enable and monitor Checkmk audit logs for pending change creation events with unusual patterns
• Deploy browser-based XSS detection tools or content security policy (CSP) violation monitoring
• Correlate user activity logs to identify pending changes created by compromised or suspicious accounts

Monitoring Recommendations

• Configure alerting for CSP violations that may indicate attempted or successful XSS exploitation
• Monitor for unusual patterns in Checkmk user session activity, particularly following pending change views
• Implement network traffic analysis to detect exfiltration attempts to external domains from Checkmk users
• Review pending change entries periodically for suspicious content or unauthorized modifications

How to Mitigate CVE-2026-20915

Immediate Actions Required

• Upgrade Checkmk to version 2.5.0b2 or later immediately
• Review existing pending changes for any suspicious or malicious content and remove them
• Audit user accounts with pending change permissions and restrict access where appropriate
• Implement Content Security Policy (CSP) headers to mitigate XSS impact as a defense-in-depth measure

Patch Information

Checkmk has addressed this vulnerability in version 2.5.0b2. Organizations running Checkmk 2.5.0b1 or earlier beta versions should upgrade immediately. Detailed information about the fix is available in the Checkmk Security Update (Werk 19526).

Workarounds

• Restrict the number of users with permissions to create pending changes to only essential personnel
• Implement strict CSP headers to prevent inline script execution as a temporary mitigation
• Consider temporarily disabling the Pending Changes sidebar feature if operationally feasible until patching is complete
• Monitor all pending change activity and require manual review before changes are visible to other users