Description
Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to execute arbitrary JavaScript in the browsers of other users performing searches in the Unified Search feature.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Checkmk | Checkmk | 2.5.0b1 – < 2.5.0b2 | 2.5.0b2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | check-mk | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | check-mk | No fix yet | — |
Advisories 1
- WID-SEC-2026-0928 Checkmk: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Mar 31, 2026