Description
Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Checkmk | Checkmk | 2.5.0b1 – < 2.5.0b2 | 2.5.0b2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | check-mk | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | check-mk | No fix yet | — |
Advisories 1
- WID-SEC-2026-0928 Checkmk: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Mar 31, 2026
References
- https://checkmk.com/werk/19526 vendor-advisory