Skip to content
OpenAdvisories
High WID-SEC-2026-1817 5 CVEs

Checkmk: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Jun 8, 2026 · Updated Jun 8, 2026 · de-DE

Vendor: Checkmk Product: Checkmk

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Checkmk ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

Checkmk ist eine IT-Monitoring-Software.

Vulnerabilities 5

  • High 8.5
    CVE-2026-7186

    Fix stored XSS in URL dashboard widget via dangerous URI schemes

    Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions to store a URL with a dangerous URI scheme such as javascript: that executes scripts in …

    Checkmk Checkmk check-mk Ubuntu
  • High 8.5
    CVE-2026-8833

    XSS in urls

    Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resul…

    Checkmk Checkmk check-mk Ubuntu
  • Medium 6.3
    CVE-2026-7765

    User Messages widget leaked issuer messages on shared dashboards

    Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing an attacker who knows a valid public dashboard share token to…

    Checkmk Checkmk check-mk Ubuntu
  • Medium 4.8
    CVE-2026-8078

    Fix stored XSS in global settings change log

    Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can change global settings to store malicious HTML or JavaScript in changelog messages that executes in…

    Checkmk Checkmk check-mk Ubuntu
  • Medium 4.8
    CVE-2026-9549

    Fix XSS in service discovery active check output

    Stored cross-site scripting in the service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can configure active or custom checks to inject malicious HTML or JavaScript into check outp…

    Checkmk Checkmk check-mk Ubuntu

Revision history

  1. #1

    Initiale Fassung

References