Stored Cross-Site Scripting in Checkmk 2.5.0 by Tribe29
CVE-2026-20915

8.5HIGH

Key Information:

Vendor

Checkmk Gmbh

Status
Checkmk
Vendor
CVE Published:
31 March 2026

What is CVE-2026-20915?

A stored cross-site scripting vulnerability exists in Checkmk version 2.5.0 (beta) prior to version 2.5.0b2. This flaw permits authenticated users with the necessary permissions to create pending changes to introduce malicious JavaScript code into the Pending Changes sidebar. The injected script subsequently executes in the web browsers of other users who view this sidebar, leading to potential security risks and data exposure.

Affected Version(s)

Checkmk 2.5.0b1 < 2.5.0b2

References

https://checkmk.com/werk/19526
vendor-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.