CVE-2026-33455
Livestatus Injection in Checkmk Quicksearch Allows Command Injection
Publication date: 2026-04-10
Last updated on: 2026-04-20
Assigner: Checkmk GmbH
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| checkmk | checkmk | 2.5.0 |
| checkmk | checkmk | 2.5.0 |
| checkmk | checkmk | 2.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-140 | The product does not neutralize or incorrectly neutralizes delimiters. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the Livestatus injection vulnerability in Checkmk affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-33455 is a Livestatus injection vulnerability found in the monitoring quicksearch feature of Checkmk versions prior to 2.5.0b4. It allows an authenticated attacker to inject Livestatus commands through the search query because the input sanitization in the search filter plugins is insufficient.
How can this vulnerability impact me? :
This vulnerability could allow an authenticated user to execute unauthorized Livestatus commands via the search query, potentially leading to manipulation or unauthorized access to monitoring data within Checkmk. Although classified as trivial in severity, it could compromise the integrity of monitoring operations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Checkmk to version 2.5.0b4 or later, or 2.6.0b1 or later, where the issue has been fixed.
The security update is fully compatible and requires no manual intervention.