Local User Exposure of NetApp Login Password in Checkmk Server
CVE-2026-103674

2LOW

Key Information:

Vendor

Checkmk Gmbh

Status
Checkmk
Vendor
CVE Published:
6 November 2026

What is CVE-2026-103674?

A local user on the Checkmk server can exploit a vulnerability in Checkmk version 2.5.0 through version 2.5.0p16 by invoking the NetApp ONTAP special agent. This allows the user to access the NetApp login password from the process list while the special agent is active. Both explicitly configured passwords and those stored in the system's password store are susceptible to exposure, leading to potential unauthorized access and a significant security risk.

Affected Version(s)

Checkmk 2.5.0 < 2.5.0p16

References

https://checkmk.com/werk/22429
vendor-advisory

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.