CVE-2026-33456
Received Received - Intake
Livestatus Injection in Checkmk Notification Test Allows Command Injection

Publication date: 2026-04-10

Last updated on: 2026-04-20

Assigner: Checkmk GmbH

Description
Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via a crafted service description.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-10
Last Modified
2026-04-20
Generated
2026-06-16
AI Q&A
2026-04-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-33456
EUVD
EUVD-2026-21344
Affected Vendors & Products
Showing 35 associated CPEs
Vendor Product Version / Range
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.5.0
checkmk checkmk 2.4.0
checkmk checkmk 2.4.0
checkmk checkmk 2.5.0
checkmk checkmk 2.4.0
checkmk checkmk 2.5.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-140 The product does not neutralize or incorrectly neutralizes delimiters.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-33456 is a security vulnerability in Checkmk versions prior to 2.5.0b4 and 2.4.0p26. It involves a Livestatus injection in the notification test mode, where an authenticated user with access to the notification test page can inject arbitrary Livestatus commands by crafting a malicious service description.

Impact Analysis

This vulnerability allows an authenticated user with access to the notification test page to execute arbitrary Livestatus commands. This could lead to unauthorized actions within the Checkmk monitoring system, potentially compromising the integrity and reliability of monitoring data and operations.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Checkmk installation to a fixed version such as 2.6.0b1, 2.5.0b4, or 2.4.0p26 or later.

The fix applies to multiple Checkmk editions including Community, Pro, Ultimate, and Ultimate MT, and requires no manual intervention.

Compliance Impact

The provided information does not specify how the Livestatus injection vulnerability in Checkmk affects compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33456. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart