CVE-2026-14452
Deferred Deferred - Pending Action

Stored XSS in Checkmk via Reset URL Parameter

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Checkmk GmbH

Description
Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-14452
EUVD
EUVD-2026-102834

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Checkmk GmbH Checkmk 2.5.0
Checkmk GmbH Checkmk 2.4.0
Checkmk GmbH Checkmk 2.3.0
Checkmk GmbH Checkmk 2.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an open redirect and cross-site scripting (XSS) flaw in Checkmk versions before 2.5.0p15, 2.4.0p38, 2.3.0p51, and 2.2.0 (EOL). It involves improper validation of the reset_url parameter in the Setup in-page search. An attacker can craft a URL with a malicious javascript: scheme or external URL to execute arbitrary scripts in an authenticated user's session or redirect them to an external site.

Detection Guidance

Check web server access logs for suspicious reset_url parameters containing javascript: or external URLs. Look for entries with Setup access pages and in-page search interactions.

Impact Analysis

If you have Setup access in Checkmk, an attacker could trick you into clicking a crafted URL. This could execute malicious scripts in your session or redirect you to a harmful website. Exploitation requires only one click and Setup access.

Compliance Impact

This vulnerability could lead to unauthorized script execution or redirection in authenticated user sessions, potentially enabling data exfiltration or session hijacking. Such risks may violate GDPR's requirement for secure processing of personal data and HIPAA's safeguards for protected health information if exploited in healthcare or EU-based systems.

Mitigation Strategies

Upgrade Checkmk to versions 2.5.0p15, 2.4.0p38, 2.3.0p51 or later. If upgrading is not possible, restrict access to Setup pages until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14452. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart