CVE-2026-33456
Livestatus Injection in Checkmk Notification Test Allows Command Injection
Publication date: 2026-04-10
Last updated on: 2026-04-20
Assigner: Checkmk GmbH
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.5.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.5.0 |
| checkmk | checkmk | 2.4.0 |
| checkmk | checkmk | 2.5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-140 | The product does not neutralize or incorrectly neutralizes delimiters. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33456 is a security vulnerability in Checkmk versions prior to 2.5.0b4 and 2.4.0p26. It involves a Livestatus injection in the notification test mode, where an authenticated user with access to the notification test page can inject arbitrary Livestatus commands by crafting a malicious service description.
How can this vulnerability impact me? :
This vulnerability allows an authenticated user with access to the notification test page to execute arbitrary Livestatus commands. This could lead to unauthorized actions within the Checkmk monitoring system, potentially compromising the integrity and reliability of monitoring data and operations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your Checkmk installation to a fixed version such as 2.6.0b1, 2.5.0b4, or 2.4.0p26 or later.
The fix applies to multiple Checkmk editions including Community, Pro, Ultimate, and Ultimate MT, and requires no manual intervention.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the Livestatus injection vulnerability in Checkmk affects compliance with common standards and regulations such as GDPR or HIPAA.