CVE-2026-90990: Livestatus injection via monitoring filter values
Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services outside their contact groups and occupying web server and Livestatus workers for an attacker-controlled duration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Checkmkto a version that resolves this vulnerability.Fixed in 2.5.0p14
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can supply filter values to the monitoring host or service list APIs can exploit it. The impact is limited to inferring information about hosts and services outside that user's assigned contact groups and consuming web server and Livestatus worker capacity.
Which deployments are affected?
Checkmk versions earlier than 2.5.0p14 are affected. The provided information does not identify any configuration prerequisite beyond use of the affected monitoring host or service list APIs.
What can an attacker do with the injected headers?
The attacker can inject additional Livestatus query headers through newline characters in filter values. In count queries, this can bypass object visibility restrictions to reveal information about otherwise inaccessible hosts and services, and can hold workers for an attacker-controlled duration.