Improper Certificate Validation in Checkmk

Executive Summary

This vulnerability involves improper certificate validation in Checkmk versions before 2.5.0p18, 2.4.0p39, 2.3.0p52, and 2.2.0 (EOL). The issue stems from bundled Certificate Authority stores using compromised eMudhra (emSign) root CA certificates with public private keys. Attackers could exploit this to issue fraudulent TLS certificates for any hostname, enabling interception or modification of encrypted traffic.

Useful 0 Not Useful 0

Detection Guidance

Checkmk versions below 2.5.0p18, 2.4.0p39, 2.3.0p52, or 2.2.0 are vulnerable. Verify installed versions with 'omd version' or 'check_mk --version'. Inspect Python environments for certifi versions before 2026.10.19 using 'pip show certifi' or 'python -c "import certifi; print(certifi.__version__)"'.

Useful 0 Not Useful 0

Impact Analysis

If you use affected Checkmk versions, attackers could intercept or alter TLS traffic between your systems and external services. This affects agent updaters on Linux, Windows plug-ins relying on Python modules, and site processes where SSL_CERT_FILE or REQUESTS_CA_BUNDLE are not set. Services using HTTPS endpoints may fail if they depend on removed root CAs.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to breaches of confidentiality and integrity requirements under GDPR and HIPAA. Unauthorized interception or modification of TLS traffic may violate data protection obligations, especially for sensitive personal or health data. Organizations must address this to maintain compliance with encryption and data security mandates.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Checkmk to versions 2.5.0p18, 2.4.0p39, 2.3.0p52 or later. Ensure certifi is updated to 2026.10.19 or newer. Rebuild container images with updated certifi. For Checkmk, no manual interaction is required as fixes are included in patches.

Useful 0 Not Useful 0