CVE-2026-9549: Fix XSS in service discovery active check output
Published Jun 8, 2026
·Updated
Stored cross-site scripting in the service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can configure active or custom checks to inject malicious HTML or JavaScript into check output that executes in the browser of an admin or a user with host read permissions when they run the check on the service discovery page.
Affected Software
158 affected components
Tribe29 Checkmk<2.5.0p5, <2.4.0p31, <2.3.0p48, >=2.2.0<2.3.0
Checkmk Checkmk=2.2.0
Checkmk Checkmk=2.2.0-b1
Checkmk Checkmk=2.2.0-b2
Checkmk Checkmk=2.2.0-b3
Checkmk Checkmk=2.2.0-b4
Checkmk Checkmk=2.2.0-b5
Checkmk Checkmk=2.2.0-b6
Checkmk Checkmk=2.2.0-b7
Checkmk Checkmk=2.2.0-b8
Checkmk Checkmk=2.2.0-i1
Checkmk Checkmk=2.2.0-p1
Checkmk Checkmk=2.2.0-p10
Checkmk Checkmk=2.2.0-p11
Checkmk Checkmk=2.2.0-p12
Checkmk Checkmk=2.2.0-p13
Checkmk Checkmk=2.2.0-p14
Checkmk Checkmk=2.2.0-p15
Checkmk Checkmk=2.2.0-p16
Checkmk Checkmk=2.2.0-p17
Checkmk Checkmk=2.2.0-p18
Checkmk Checkmk=2.2.0-p19
Checkmk Checkmk=2.2.0-p2
Checkmk Checkmk=2.2.0-p20
Checkmk Checkmk=2.2.0-p21
Checkmk Checkmk=2.2.0-p22
Checkmk Checkmk=2.2.0-p23
Checkmk Checkmk=2.2.0-p24
Checkmk Checkmk=2.2.0-p25
Checkmk Checkmk=2.2.0-p26
Checkmk Checkmk=2.2.0-p27
Checkmk Checkmk=2.2.0-p28
Checkmk Checkmk=2.2.0-p29
Checkmk Checkmk=2.2.0-p3
Checkmk Checkmk=2.2.0-p30
Checkmk Checkmk=2.2.0-p31
Checkmk Checkmk=2.2.0-p32
Checkmk Checkmk=2.2.0-p33
Checkmk Checkmk=2.2.0-p34
Checkmk Checkmk=2.2.0-p35
Checkmk Checkmk=2.2.0-p36
Checkmk Checkmk=2.2.0-p37
Checkmk Checkmk=2.2.0-p38
Checkmk Checkmk=2.2.0-p39
Checkmk Checkmk=2.2.0-p4
Checkmk Checkmk=2.2.0-p40
Checkmk Checkmk=2.2.0-p41
Checkmk Checkmk=2.2.0-p42
Checkmk Checkmk=2.2.0-p43
Checkmk Checkmk=2.2.0-p44
Checkmk Checkmk=2.2.0-p45
Checkmk Checkmk=2.2.0-p46
Checkmk Checkmk=2.2.0-p47
Checkmk Checkmk=2.2.0-p5
Checkmk Checkmk=2.2.0-p6
Checkmk Checkmk=2.2.0-p7
Checkmk Checkmk=2.2.0-p8
Checkmk Checkmk=2.2.0-p9
Checkmk Checkmk=2.3.0
Checkmk Checkmk=2.3.0-b1
Checkmk Checkmk=2.3.0-b2
Checkmk Checkmk=2.3.0-b3
Checkmk Checkmk=2.3.0-b4
Checkmk Checkmk=2.3.0-b5
Checkmk Checkmk=2.3.0-b6
Checkmk Checkmk=2.3.0-p1
Checkmk Checkmk=2.3.0-p10
Checkmk Checkmk=2.3.0-p11
Checkmk Checkmk=2.3.0-p12
Checkmk Checkmk=2.3.0-p13
Checkmk Checkmk=2.3.0-p14
Checkmk Checkmk=2.3.0-p15
Checkmk Checkmk=2.3.0-p16
Checkmk Checkmk=2.3.0-p17
Checkmk Checkmk=2.3.0-p18
Checkmk Checkmk=2.3.0-p19
Checkmk Checkmk=2.3.0-p2
Checkmk Checkmk=2.3.0-p20
Checkmk Checkmk=2.3.0-p21
Checkmk Checkmk=2.3.0-p22
Checkmk Checkmk=2.3.0-p23
Checkmk Checkmk=2.3.0-p24
Checkmk Checkmk=2.3.0-p25
Checkmk Checkmk=2.3.0-p26
Checkmk Checkmk=2.3.0-p27
Checkmk Checkmk=2.3.0-p28
Checkmk Checkmk=2.3.0-p29
Checkmk Checkmk=2.3.0-p3
Checkmk Checkmk=2.3.0-p30
Checkmk Checkmk=2.3.0-p31
Checkmk Checkmk=2.3.0-p32
Checkmk Checkmk=2.3.0-p33
Checkmk Checkmk=2.3.0-p34
Checkmk Checkmk=2.3.0-p35
Checkmk Checkmk=2.3.0-p36
Checkmk Checkmk=2.3.0-p37
Checkmk Checkmk=2.3.0-p38
Checkmk Checkmk=2.3.0-p39
Checkmk Checkmk=2.3.0-p4
Checkmk Checkmk=2.3.0-p40
Checkmk Checkmk=2.3.0-p41
Checkmk Checkmk=2.3.0-p42
Checkmk Checkmk=2.3.0-p43
Checkmk Checkmk=2.3.0-p44
Checkmk Checkmk=2.3.0-p45
Checkmk Checkmk=2.3.0-p46
Checkmk Checkmk=2.3.0-p47
Checkmk Checkmk=2.3.0-p5
Checkmk Checkmk=2.3.0-p6
Checkmk Checkmk=2.3.0-p7
Checkmk Checkmk=2.3.0-p8
Checkmk Checkmk=2.3.0-p9
Checkmk Checkmk=2.4.0
Checkmk Checkmk=2.4.0
Checkmk Checkmk=2.4.0-b1
Checkmk Checkmk=2.4.0-b2
Checkmk Checkmk=2.4.0-b3
Checkmk Checkmk=2.4.0-b4
Checkmk Checkmk=2.4.0-b5
Checkmk Checkmk=2.4.0-b6
Checkmk Checkmk=2.4.0-p1
Checkmk Checkmk=2.4.0-p10
Checkmk Checkmk=2.4.0-p11
Checkmk Checkmk=2.4.0-p12
Checkmk Checkmk=2.4.0-p13
Checkmk Checkmk=2.4.0-p14
Checkmk Checkmk=2.4.0-p15
Checkmk Checkmk=2.4.0-p16
Checkmk Checkmk=2.4.0-p17
Checkmk Checkmk=2.4.0-p18
Checkmk Checkmk=2.4.0-p19
Checkmk Checkmk=2.4.0-p2
Checkmk Checkmk=2.4.0-p20
Checkmk Checkmk=2.4.0-p21
Checkmk Checkmk=2.4.0-p22
Checkmk Checkmk=2.4.0-p23
Checkmk Checkmk=2.4.0-p24
Checkmk Checkmk=2.4.0-p25
Checkmk Checkmk=2.4.0-p26
Checkmk Checkmk=2.4.0-p27
Checkmk Checkmk=2.4.0-p28
Checkmk Checkmk=2.4.0-p29
Checkmk Checkmk=2.4.0-p3
Checkmk Checkmk=2.4.0-p30
Checkmk Checkmk=2.4.0-p4
Checkmk Checkmk=2.4.0-p5
Checkmk Checkmk=2.4.0-p6
Checkmk Checkmk=2.4.0-p7
Checkmk Checkmk=2.4.0-p8
Checkmk Checkmk=2.4.0-p9
Checkmk Checkmk=2.5.0
Checkmk Checkmk=2.5.0-b1
Checkmk Checkmk=2.5.0-b2
Checkmk Checkmk=2.5.0-b3
Checkmk Checkmk=2.5.0-p1
Checkmk Checkmk=2.5.0-p2
Checkmk Checkmk=2.5.0-p3
Checkmk Checkmk=2.5.0-p4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Checkmkto a version that resolves this vulnerability.Fixed in 2.5.0p5 - Upgrade
Upgrade
Checkmkto a version that resolves this vulnerability.Fixed in 2.4.0p31 - Upgrade
Upgrade
Checkmkto a version that resolves this vulnerability.Fixed in 2.3.0p48 - Upgrade
Upgrade
Checkmkto a version that resolves this vulnerability.Fixed in 2.2.0
Event History
Jun 8, 2026
CVE Published
via MITRE·12:07 PM
Data Sourced
via MITRE·12:07 PM
DescriptionWeakness
Data Sourced
via NVD·01:16 PM
DescriptionSeverityWeaknessAffected Software
Apr 28, 58520
Event
via FIRST·02:39 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-9549?
CVE-2026-9549 has a medium severity rating of 4.8 according to the CVSS score.
2
How do I fix CVE-2026-9549?
To fix CVE-2026-9549, update Checkmk to version 2.5.0p5, 2.4.0p31, or 2.3.0p48 or later.
3
What type of vulnerability is CVE-2026-9549?
CVE-2026-9549 is classified as a stored cross-site scripting (XSS) vulnerability.
4
Who is affected by CVE-2026-9549?
Administrators who configure active or custom checks in affected versions of Checkmk are at risk from CVE-2026-9549.
5
When was CVE-2026-9549 published?
CVE-2026-9549 was published on June 8, 2026.