The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does…
Priority MEDIUM 46CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-434.
Summary
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of ".mkp" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session of a user with administrator role. NOTE: the vendor states that this is the intended behavior: admins are supposed to be able to execute code in this manner.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03027 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:checkmk:checkmk:2.0.0:-:*:*:*:*:*:* | 2.0.0 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:b1:*:*:*:*:*:* | 2.0.0 b1 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:b2:*:*:*:*:*:* | 2.0.0 b2 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:b3:*:*:*:*:*:* | 2.0.0 b3 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:b4:*:*:*:*:*:* | 2.0.0 b4 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:b5:*:*:*:*:*:* | 2.0.0 b5 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:b6:*:*:*:*:*:* | 2.0.0 b6 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:b7:*:*:*:*:*:* | 2.0.0 b7 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:b8:*:*:*:*:*:* | 2.0.0 b8 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:i1:*:*:*:*:*:* | 2.0.0 i1 | Vulnerable | Checkmk GmbH |
- cpe:2.3:a:checkmk:checkmk:2.0.0:-:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:b1:*:*:*:*:*:* Versions 2.0.0 b1 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:b2:*:*:*:*:*:* Versions 2.0.0 b2 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:b3:*:*:*:*:*:* Versions 2.0.0 b3 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:b4:*:*:*:*:*:* Versions 2.0.0 b4 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:b5:*:*:*:*:*:* Versions 2.0.0 b5 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:b6:*:*:*:*:*:* Versions 2.0.0 b6 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:b7:*:*:*:*:*:* Versions 2.0.0 b7 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:b8:*:*:*:*:*:* Versions 2.0.0 b8 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:i1:*:*:*:*:*:* Versions 2.0.0 i1 Vulnerable ·Checkmk GmbH
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:checkmk:checkmk:2.0.0:p1:*:*:*:*:*:* | 2.0.0 p1 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p10:*:*:*:*:*:* | 2.0.0 p10 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p11:*:*:*:*:*:* | 2.0.0 p11 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p12:*:*:*:*:*:* | 2.0.0 p12 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p13:*:*:*:*:*:* | 2.0.0 p13 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p14:*:*:*:*:*:* | 2.0.0 p14 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p15:*:*:*:*:*:* | 2.0.0 p15 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p16:*:*:*:*:*:* | 2.0.0 p16 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p17:*:*:*:*:*:* | 2.0.0 p17 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p2:*:*:*:*:*:* | 2.0.0 p2 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p3:*:*:*:*:*:* | 2.0.0 p3 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p4:*:*:*:*:*:* | 2.0.0 p4 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p5:*:*:*:*:*:* | 2.0.0 p5 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p6:*:*:*:*:*:* | 2.0.0 p6 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p7:*:*:*:*:*:* | 2.0.0 p7 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p8:*:*:*:*:*:* | 2.0.0 p8 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:checkmk:checkmk:2.0.0:p9:*:*:*:*:*:* | 2.0.0 p9 | Vulnerable | Checkmk GmbH |
| cpe:2.3:a:tribe29:checkmk:*:*:*:*:*:*:*:* | 1.5.0 to before 2.0.0 | Vulnerable | Tribe29 |
- cpe:2.3:a:checkmk:checkmk:2.0.0:p1:*:*:*:*:*:* Versions 2.0.0 p1 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p10:*:*:*:*:*:* Versions 2.0.0 p10 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p11:*:*:*:*:*:* Versions 2.0.0 p11 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p12:*:*:*:*:*:* Versions 2.0.0 p12 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p13:*:*:*:*:*:* Versions 2.0.0 p13 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p14:*:*:*:*:*:* Versions 2.0.0 p14 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p15:*:*:*:*:*:* Versions 2.0.0 p15 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p16:*:*:*:*:*:* Versions 2.0.0 p16 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p17:*:*:*:*:*:* Versions 2.0.0 p17 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p2:*:*:*:*:*:* Versions 2.0.0 p2 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p3:*:*:*:*:*:* Versions 2.0.0 p3 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p4:*:*:*:*:*:* Versions 2.0.0 p4 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p5:*:*:*:*:*:* Versions 2.0.0 p5 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p6:*:*:*:*:*:* Versions 2.0.0 p6 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p7:*:*:*:*:*:* Versions 2.0.0 p7 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p8:*:*:*:*:*:* Versions 2.0.0 p8 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:checkmk:checkmk:2.0.0:p9:*:*:*:*:*:* Versions 2.0.0 p9 Vulnerable ·Checkmk GmbH
- cpe:2.3:a:tribe29:checkmk:*:*:*:*:*:*:*:* Versions 1.5.0 to before 2.0.0 Vulnerable ·Tribe29
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-40905
- 2026-10-03 Alias added: GHSA-83pm-xjc4-cg4w
References
Sources
- CVE-2021-40905 · CVE Program
- CVE-2021-40905 · NVD
- FIRST EPSS
- GHSA-83pm-xjc4-cg4w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences