CVE-2026-7186: Fix stored XSS in URL dashboard widget via dangerous URI schemes
Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions to store a URL with a dangerous URI scheme such as javascript: that executes scripts in other users' browsers when they view the dashboard.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Checkmkto a version that resolves this vulnerability.Fixed in 2.5.0p5 - Upgrade
Upgrade
Checkmkto a version that resolves this vulnerability.Fixed in 2.4.0p31 - Upgrade
Upgrade
Checkmkto a version that resolves this vulnerability.Fixed in 2.3.0p48 - Compensating control
Restrict dashboard editing permissions to trusted users and groups to prevent untrusted users from storing URLs with dangerous URI schemes (such as javascript:)
- Operational
Audit existing dashboards for URLs using dangerous URI schemes (e.g. javascript:) and remove or sanitize any malicious entries found; notify affected users if malicious content was exposed
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7186?
The severity of CVE-2026-7186 is high with a CVSS score of 8.5.
How do I fix CVE-2026-7186?
To fix CVE-2026-7186, update Checkmk to versions greater than 2.5.0p5, 2.4.0p31, 2.3.0p48, or use a version other than 2.2.0.
What type of vulnerability is CVE-2026-7186?
CVE-2026-7186 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-7186?
Users with dashboard editing permissions in Checkmk versions below specified thresholds are affected by CVE-2026-7186.
What can attackers do with CVE-2026-7186?
Attackers can exploit CVE-2026-7186 to execute scripts in the browsers of users viewing the dashboard, potentially leading to data theft or session hijacking.