Read the docs
TI-2026-16938 Aliases CVE-2026-20915GHSA-c37f-qch7-r2cg

Stored cross-site scripting in Pending Changes sidebar

Priority LOW 38CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-07
Fix Fixed Checkmk (Checkmk GmbH): 2.5.0b2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Checkmk GmbHCheckmk2.5.0b1 to before 2.5.0b22.5.0b2Patch availableCNA
  • Checkmk VendorCheckmk GmbH Affected 2.5.0b1 to before 2.5.0b2 Fixed in 2.5.0b2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:checkmk:checkmk:2.5.0:b1:*:*:*:*:*:*2.5.0 b1VulnerableCheckmk GmbH
  • cpe:2.3:a:checkmk:checkmk:2.5.0:b1:*:*:*:*:*:* Versions 2.5.0 b1 Vulnerable ·Checkmk GmbH

Remediation

  • Fix · CNA Checkmk (Checkmk GmbH) Fixed in 2.5.0b2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Checkmk 2.5.0b2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-25688 XSS in Unified Search via Unescaped Host/Service NamesPriority LOW 38
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-20915
  2. 2026-10-03 Alias added: GHSA-c37f-qch7-r2cg

References

Advisory 1

  • TI-2025-26345 Cross Site Scripting through compromised remote site CVSS 4.0HIGH 8.5
  • TI-2025-40190 Cross-site scripting in HTML logs of Synthetic Monitoring test services CVSS 4.0HIGH 7.3
  • TI-2024-19037 Brute-force protection ineffective for some login methods CVSS 3.1CRITICAL 9.8
  • TI-2024-05712 local IP restriction of internal HTTP endpoints CVSS 3.1CRITICAL 9.8
  • TI-2021-17818 The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does… CVSS 3.1HIGH 8.8
  • TI-2021-17817 The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a… CVSS 3.1HIGH 8.8
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences