CVE-2026-103682: Jolokia special agent exposes password in process list

Published Nov 6, 2026

Updated

Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the Jolokia login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Checkmk to a version that resolves this vulnerability.
Fixed in 2.5.0p16

Event History

Nov 6, 2026

CVE Published

via MITRE·09:07 AM

Data Sourced

via MITRE·09:07 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A local user on the Checkmk server can read the Jolokia login password from the process list while the special agent is running.

Are passwords from the password store affected?

Yes. The exposure affects both passwords explicitly configured for the Jolokia special agent and passwords retrieved from the password store.

How can I determine whether my deployment is affected?

Check whether the Jolokia special agent runs on Checkmk 2.5.0 earlier than 2.5.0p16 and whether local users on the Checkmk server can inspect running processes while the agent executes.

CVE-2026-103682: Jolokia special agent exposes password in process list

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are passwords from the password store affected?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are passwords from the password store affected?

How can I determine whether my deployment is affected?