Improper URL Validation in Checkmk by Tribe29
CVE-2026-14452

8.6HIGH

Key Information:

Vendor

Checkmk Gmbh

Status
Checkmk
Vendor
CVE Published:
16 October 2026

What is CVE-2026-14452?

The Checkmk product by Tribe29 contains a vulnerability due to improper validation of the reset_url parameter during an in-page search. This allows an attacker with Setup access to manipulate the session of an authenticated user. By deceiving the user into clicking a maliciously crafted URL, the attacker can execute arbitrary scripts in the user's session or redirect them to unauthorized external sites, compromising the security of the user's data and actions.

Affected Version(s)

Checkmk 2.5.0 < 2.5.0p15

Checkmk 2.4.0 < 2.4.0p38

Checkmk 2.3.0 < 2.3.0p51

References

https://checkmk.com/werk/22314
vendor-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.