CVE-2026-17548: Missing authorization for viewing background jobs

Q: Who can exploit this issue?

An attacker must be authenticated to Checkmk and know the ID of a background job. No user interaction is required.

Q: What information could be exposed?

The attacker can view the status and results of background jobs. The available data does not indicate that the attacker can modify jobs or affect availability.

Q: Which releases are affected?

Affected releases are Checkmk versions earlier than 2.5.0p12, earlier than 2.4.0p36, earlier than 2.3.0p50, and all 2.2.0 versions.

Published Aug 25, 2026

Updated

Missing authorization in Checkmk <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results.

Affected Software

1 affected component

Checkmk Checkmk<2.5.0p12, <2.4.0p36, <2.3.0p50, >=2.2.0<=2.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Checkmk to a version that resolves this vulnerability.
Fixed in 2.5.0p12
Upgrade
Upgrade Checkmk to a version that resolves this vulnerability.
Fixed in 2.4.0p36
Upgrade
Upgrade Checkmk to a version that resolves this vulnerability.
Fixed in 2.3.0p50
Upgrade
Upgrade Checkmk to a version that resolves this vulnerability.
Fixed in 2.2.0

Event History

Aug 25, 2026

CVE Published

via MITRE·08:35 AM

Data Sourced

via MITRE·08:35 AM

DescriptionWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to Checkmk and know the ID of a background job. No user interaction is required.

What information could be exposed?