CVE-2026-20915
Stored XSS in Checkmk Pending Changes Sidebar Allows Script Injection
Publication date: 2026-03-31
Last updated on: 2026-04-02
Assigner: Checkmk GmbH
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| checkmk | checkmk | 2.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-20915 is a stored cross-site scripting (XSS) vulnerability found in the Pending Changes sidebar of Checkmk versions 2.5.0 and 2.6.0b1. Authenticated users who have permission to create pending changes can inject malicious JavaScript code into change attributes because these inputs are not properly sanitized before being displayed. When other users view the Pending Changes sidebar, the malicious script executes in their browsers, potentially compromising their security.
How can this vulnerability impact me? :
This vulnerability can lead to malicious JavaScript executing in the browsers of users who view the Pending Changes sidebar. This can result in unauthorized actions being performed on behalf of those users, theft of sensitive information such as session cookies, or other malicious activities that compromise user accounts and system integrity.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed in the Werk #19526 update for Checkmk versions 2.5.0 and 2.6.0b1 across all editions.
To mitigate this vulnerability, you should update your Checkmk installation to the fixed version as provided in the Werk #19526 update.
The fix requires no manual interaction and maintains compatibility with existing configurations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the stored cross-site scripting (XSS) vulnerability in Checkmk affects compliance with common standards and regulations such as GDPR or HIPAA.