Stored Cross-Site Scripting Vulnerability in Checkmk by Tribe29
CVE-2026-33276

8.6HIGH

Key Information:

Vendor

Checkmk Gmbh

Status
Checkmk
Vendor
CVE Published:
31 March 2026

What is CVE-2026-33276?

A stored cross-site scripting vulnerability exists in Checkmk versions up to 2.5.0 (beta) before 2.5.0b2. This issue allows authenticated users, who have the necessary permissions to create hosts or services, to inject malicious JavaScript code. When other users perform searches in the Unified Search feature, this JavaScript is executed in their browsers, potentially leading to unauthorized actions or data exposure.

Affected Version(s)

Checkmk 2.5.0b1 < 2.5.0b2

References

https://checkmk.com/werk/19525

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.