TI-2026-75207 Aliases CVE-2026-14452 GHSA-v923-r34g-79c7

Open redirect and cross-site scripting in Checkmk Setup search

LOW 39CWE-601Published 2026-10-16 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

Checkmk before 2.5.0p15, before 2.4.0p38, before 2.3.0p51 and 2.2.0 (end of life) does not properly validate the reset_url parameter of the Setup in-page search. An attacker who tricks an authenticated user with Setup access into opening a crafted URL and clicking Reset or submitting an empty search can run script in that user's session or redirect them to an arbitrary external site (CWE-601).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00295 22nd percentileScored 2026-11-07

Fix Fixed Checkmk (Checkmk GmbH): 2.5.0p15, 2.4.0p38, 2.3.0p51

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Checkmk GmbH	Checkmk	2.5.0 to before 2.5.0p15; 2.4.0 to before 2.4.0p38; 2.3.0 to before 2.3.0p51; 2.2.0	2.5.0p15, 2.4.0p38, 2.3.0p51	Patch available	CNA

Checkmk VendorCheckmk GmbH Affected 2.5.0 to before 2.5.0p15; 2.4.0 to before 2.4.0p38; 2.3.0 to before 2.3.0p51; 2.2.0 Fixed in 2.5.0p15, 2.4.0p38, 2.3.0p51 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:checkmk:checkmk::::::::	—	—	Checkmk GmbH

cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:* Versions — — ·Checkmk GmbH

Remediation

Upgrade Checkmk to 2.5.0p15, 2.4.0p38 or 2.3.0p51, which fix the flaw. The sources list no fixed version for Checkmk 2.2.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Checkmk (Checkmk GmbH) Fixed in 2.5.0p15, 2.4.0p38, 2.3.0p51

Timeline

2026-10-16 Threatist record created from CVE-2026-14452
2026-10-16 Alias added: GHSA-v923-r34g-79c7

References

Advisory 1

https://checkmk.com/werk/22314

TI-2025-26345 Cross Site Scripting through compromised remote site CVSS 4.0HIGH 8.5
TI-2025-40190 Cross-site scripting in HTML logs of Synthetic Monitoring test services CVSS 4.0HIGH 7.3
TI-2024-12762 Checkmk NagVis Remote Code Execution CVSS 3.1HIGH 7.2
TI-2024-12761 Checkmk NagVis Reflected Cross-site Scripting CVSS 3.1MEDIUM 5.4
TI-2024-19037 Brute-force protection ineffective for some login methods CVSS 3.1CRITICAL 9.8
TI-2024-05712 local IP restriction of internal HTTP endpoints CVSS 3.1CRITICAL 9.8

See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences