CVE-2026-121374Checkmk GmbH Checkmk
NVD
Vulnerability Summary
Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in the "Exclude nodes based on their role" rule option, leading to code execution as the site user.
CVSS v4.0 Base Metrics — Score 9.4 (CRITICAL)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HAttack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredLow
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)High
Integrity (Subsequent System)High
Availability (Subsequent System)High
Affected & Patched Versions
- Checkmk GmbH Checkmk >= 2.5.0 and < 2.5.0p19
- Checkmk GmbH Checkmk >= 2.4.0 and < 2.4.0p40
- Checkmk GmbH Checkmk 2.3.0
- Checkmk GmbH Checkmk 2.5.0p19
- Checkmk GmbH Checkmk 2.4.0p40
What to do
Plan remediation soon. No exploitation is confirmed yet, but the severity is critical.
- Check whether you run Checkmk GmbH Checkmk and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Nov 11, 2026Published
- Nov 14, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Checkmk GmbH Checkmk CVEsYou are reading CVE-2026-121374. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsExternal References
- Referencehttps://checkmk.com/werk/17994
Data last checked: Nov 14, 2026 05:11 UTC