Read the docs
TI-2026-85794 Aliases CVE-2026-103674GHSA-6vww-3h55-pc3j

NetApp ONTAP special agent exposes password in process list

Priority LOW 10CWE-214Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Checkmk versions from 2.5.0 before 2.5.0p16 pass the login password of the NetApp ONTAP special agent on its command line. A local user on the Checkmk server can read the NetApp login password from the process list while the special agent runs (CWE-214). This applies to both explicitly configured passwords and passwords taken from the password store.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the NetApp login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.

Why it matters now

EPSS 0.00099 0th percentileScored 2026-11-07
Fix Fixed Checkmk (Checkmk GmbH): 2.5.0p16

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Checkmk GmbHCheckmk2.5.0 to before 2.5.0p162.5.0p16Patch availableCNA
  • Checkmk VendorCheckmk GmbH Affected 2.5.0 to before 2.5.0p16 Fixed in 2.5.0p16 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*——Checkmk GmbH
  • cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:* Versions — — ·Checkmk GmbH

Remediation

Upgrade Checkmk to version 2.5.0p16.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Checkmk (Checkmk GmbH) Fixed in 2.5.0p16

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Checkmk 2.5.0p16

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-85795 Jolokia special agent exposes password in process listPriority LOW 10
    Show all 2 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-103674
  2. 2026-11-06 Alias added: GHSA-6vww-3h55-pc3j

References

Advisory 1

  • TI-2025-26345 Cross Site Scripting through compromised remote site CVSS 4.0HIGH 8.5
  • TI-2025-40190 Cross-site scripting in HTML logs of Synthetic Monitoring test services CVSS 4.0HIGH 7.3
  • TI-2024-12762 Checkmk NagVis Remote Code Execution CVSS 3.1HIGH 7.2
  • TI-2024-12761 Checkmk NagVis Reflected Cross-site Scripting CVSS 3.1MEDIUM 5.4
  • TI-2024-19037 Brute-force protection ineffective for some login methods CVSS 3.1CRITICAL 9.8
  • TI-2024-05712 local IP restriction of internal HTTP endpoints CVSS 3.1CRITICAL 9.8
See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences