CVE-2026-15937: Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint
Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Checkmk versions earlier than 2.5.0p10 are affected when a relay and a push agent share the same UUID. The issue concerns mTLS authentication to agent receiver endpoints.
What must an attacker or unauthorized endpoint have to exploit this?
It must possess an mTLS certificate issued for the other endpoint that shares the same UUID. The vulnerable endpoints accept that certificate because they do not verify that it was issued by their own root certificate.
What is the practical authentication impact?
A relay and push agent sharing a UUID can reuse one another's mTLS certificates to authenticate to each other's agent receiver endpoints. This can allow authentication in either direction with a certificate intended for the other endpoint.