Local User Password Exposure in Checkmk by Checkmk GmbH
CVE-2026-103682

2LOW

Key Information:

Vendor

Checkmk Gmbh

Status
Checkmk
Vendor
CVE Published:
6 November 2026

What is CVE-2026-103682?

In Checkmk versions 2.5.0 up to 2.5.0p15, the invocation of the Jolokia special agent with the login password in the command line allows local users on the Checkmk server to read the Jolokia login password from the process list while the agent is in operation. This vulnerability impacts passwords that are explicitly configured as well as those stored in the password store, potentially compromising the security of sensitive information.

Affected Version(s)

Checkmk 2.5.0 < 2.5.0p16

References

https://checkmk.com/werk/22409
vendor-advisory

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.