CVE-2026-33457: Checkmk Livestatus Injection Vulnerability

CVE-2026-33457 Overview

A Livestatus injection vulnerability exists in the prediction graph page of Checkmk monitoring software. This flaw allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value. The vulnerability affects Checkmk versions prior to 2.5.0b4, 2.4.0p26, and 2.3.0p47.

Critical Impact

Authenticated attackers can execute arbitrary Livestatus commands, potentially allowing unauthorized data access, manipulation of monitoring data, or disruption of monitoring operations within the Checkmk environment.

Affected Products

• Checkmk versions prior to 2.5.0b4
• Checkmk versions prior to 2.4.0p26
• Checkmk versions prior to 2.3.0p47

Discovery Timeline

• 2026-04-10 - CVE CVE-2026-33457 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-33457

Vulnerability Analysis

This vulnerability is classified under CWE-140 (Improper Neutralization of Delimiters), indicating that the application fails to properly sanitize or neutralize special delimiter characters in user-supplied input before passing it to an interpreter.

Livestatus is a query interface used by Checkmk to retrieve real-time monitoring data from the core monitoring engine. The prediction graph page accepts a service name parameter that is incorporated into Livestatus queries without adequate input validation. An authenticated user can craft malicious service name values containing Livestatus command delimiters and operators, enabling injection of arbitrary commands into the query stream.

The network-accessible nature of this vulnerability means that any authenticated user with access to the prediction graph functionality can potentially exploit this flaw remotely. The attack requires low complexity and no user interaction beyond the initial authentication.

Root Cause

The root cause lies in insufficient input sanitization of the service description value within the prediction graph page. When processing service name parameters for Livestatus queries, the application fails to properly escape or validate delimiter characters that have special meaning in the Livestatus query language. This allows attackers to break out of the intended query context and inject additional commands.

Attack Vector

An authenticated attacker can exploit this vulnerability by navigating to the prediction graph page and supplying a specially crafted service name parameter containing Livestatus command injection payloads. The malicious input is processed without proper sanitization and interpreted as part of the Livestatus query, allowing the attacker to:

• Query sensitive monitoring data they shouldn't have access to
• Modify monitoring states or acknowledgments
• Potentially disrupt monitoring operations
• Extract configuration information from the monitoring system

The attack is network-based and can be executed by any authenticated user with access to the affected functionality.

Detection Methods for CVE-2026-33457

Indicators of Compromise

• Unusual or malformed service name parameters in web server access logs for the prediction graph page
• Unexpected Livestatus query patterns in monitoring logs
• Access attempts to prediction graph endpoints with encoded or special characters in service parameters
• Anomalous data access patterns from authenticated user accounts

Detection Strategies

• Monitor web application logs for requests to prediction graph endpoints containing suspicious characters such as newlines, semicolons, or Livestatus operators
• Implement web application firewall rules to detect injection patterns in service name parameters
• Review Livestatus query logs for anomalous or unexpected command patterns
• Configure alerting for unusual data access patterns from authenticated sessions

Monitoring Recommendations

• Enable detailed logging for the Checkmk web interface, particularly for prediction graph page access
• Implement log correlation to identify patterns of exploitation attempts across multiple requests
• Deploy endpoint detection and response (EDR) solutions to monitor for post-exploitation activity
• Regularly audit user access patterns to the prediction graph functionality

How to Mitigate CVE-2026-33457

Immediate Actions Required

• Upgrade Checkmk to version 2.5.0b4, 2.4.0p26, or 2.3.0p47 or later depending on your deployment branch
• Review web server access logs for signs of exploitation attempts
• Audit user accounts with access to prediction graph functionality
• Consider temporarily restricting access to the prediction graph page until patching is complete

Patch Information

Checkmk has addressed this vulnerability in the following versions:

• Version 2.5.0b4 and later for the 2.5.x branch
• Version 2.4.0p26 and later for the 2.4.x branch
• Version 2.3.0p47 and later for the 2.3.x branch

For detailed patch information, refer to the Checkmk Change Log Entry.

Workarounds

• Restrict access to the prediction graph page to only trusted administrative users until patching can be completed
• Implement web application firewall rules to filter requests containing suspicious characters in service name parameters
• Enable enhanced logging and monitoring for the affected endpoints to detect exploitation attempts
• Consider network segmentation to limit exposure of the Checkmk web interface to untrusted networks

# Example: Restrict access to prediction graph via Apache configuration
<Location "/*/check_mk/prediction_graph.py">
    Require group checkmk_admins
</Location>