Improper Certificate Validation in Checkmk by Tribe29
CVE-2026-117611

7.1HIGH

Key Information:

Vendor

Checkmk Gmbh

Status
Checkmk
Vendor
CVE Published:
29 October 2026

What is CVE-2026-117611?

A flaw exists in Checkmk versions prior to 2.5.0p18, 2.4.0p39, 2.3.0p52, and EOL version 2.2.0, where improper certificate validation occurs due to the inclusion of a root CA that accepts eMudhra (emSign) intermediate certificates with public private keys. This vulnerability can potentially allow malicious actors to exploit the certificate validation process, risking unauthorized access and communication interception.

Affected Version(s)

Checkmk 2.5.0 < 2.5.0p18

Checkmk 2.4.0 < 2.4.0p39

Checkmk 2.3.0 < 2.3.0p52

References

https://checkmk.com/werk/22623
vendor-advisory
https://checkmk.com/werk/22169
vendor-advisory
https://github.com/advisories/GHSA-6q48-6c7w-9gw2
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.