Checkmk fixes three critical code-execution flaws in versions 2.4 and 2.5
Heise reported that Checkmk updates 2.5.0p19 and 2.4.0p40 fix three critical vulnerabilities that can allow attackers to inject and execute code. Checkmk said a successful attack could let an attacker take over a monitored Checkmk site.
The vulnerabilities require different levels of access. Heise wrote that an attacker may need to be logged in as a legitimate user, as a monitoring administrator on a monitored site, or as a monitoring administrator on a monitored host. The latter normally corresponds to root privileges on that host, according to the report.
One flaw allows attackers who can create Robotmk agent data on a monitored host to place arbitrary files on the Checkmk site. Heise reported that an attacker could then execute arbitrary code as the site user. The attack can involve a malicious agent plugin or spool file, while service confirmation by a monitoring administrator or automatic service discovery is also required.
A second flaw in the Kubernetes special agent allows an authenticated user with permission to edit rules to write and execute an executable Python script in a site-user-writable location, Heise reported. A third flaw allows a remote site to write arbitrary files to a central Checkmk site through crafted host labels, because Checkmk did not sufficiently validate the target filename.
Heise identified the vulnerabilities as CVE-2026-120495, CVE-2026-121374 and CVE-2026-118965, each with a CVSS 4.0 score of 9.4. Until the update is installed, Checkmk advises disabling “Monitor undecided services” in the “Periodic service discovery” rule, according to Heise.
Checkmk 2.3.0 is also affected, but Heise reported that this release has reached end of life. Operators on that version must migrate to a supported release. The report said the not-yet-officially released Checkmk 3.0.0b1 is already protected.