TI-2026-13109 Aliases CVE-2026-15576 GHSA-8fww-64wc-46pf

Agent receiver accepts mTLS requests without a client certificate

LOW 37CWE-306Published 2026-08-21 · Updated 2026-08-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only the Cloud, Ultimate and Ultimate MT editions are affected, as other editions do not expose relay endpoints.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00453 39th percentileScored 2026-11-07

Fix Fixed Checkmk (Checkmk GmbH): 2.5.0p10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Checkmk GmbH	Checkmk	2.5.0 to before 2.5.0p10	2.5.0p10	Patch available	CNA

Checkmk VendorCheckmk GmbH Affected 2.5.0 to before 2.5.0p10 Fixed in 2.5.0p10 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:checkmk:checkmk::::::::	—	—	Checkmk GmbH

cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:* Versions — — ·Checkmk GmbH

Remediation

Fix · CNA Checkmk (Checkmk GmbH) Fixed in 2.5.0p10

Timeline

2026-10-02 Threatist record created from CVE-2026-15576
2026-10-03 Alias added: GHSA-8fww-64wc-46pf

References

Advisory 1

https://checkmk.com/werk/20174

TI-2025-26345 Cross Site Scripting through compromised remote site CVSS 4.0HIGH 8.5
TI-2025-40190 Cross-site scripting in HTML logs of Synthetic Monitoring test services CVSS 4.0HIGH 7.3
TI-2024-12762 Checkmk NagVis Remote Code Execution CVSS 3.1HIGH 7.2
TI-2024-12761 Checkmk NagVis Reflected Cross-site Scripting CVSS 3.1MEDIUM 5.4
TI-2024-19037 Brute-force protection ineffective for some login methods CVSS 3.1CRITICAL 9.8
TI-2024-05712 local IP restriction of internal HTTP endpoints CVSS 3.1CRITICAL 9.8

See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences