Stored Cross-Site Scripting Vulnerability in Checkmk by tribe29

CVE-2026-3466

What is CVE-2026-3466?

A stored cross-site scripting (XSS) vulnerability exists in certain versions of Checkmk that results from insufficient sanitization of dashboard dashlet title links. Attackers with dashboard creation privileges can exploit this vulnerability by crafting malicious dashlet title links. When a victim clicks on these links on a shared dashboard, it could execute arbitrary scripts in the context of the user's session, potentially compromising sensitive information and allowing unauthorized actions.

References