Stored XSS in Checkmk Service Discovery Output

Executive Summary

CVE-2026-9549 is a stored cross-site scripting (XSS) vulnerability in the service discovery active check output feature of Checkmk versions prior to 2.5.0p5, 2.4.0p31, and 2.3.0p48, including all 2.2.0 versions.

An administrator who can configure active or custom checks can inject malicious HTML or JavaScript code into the check output. This malicious code is then stored and executed in the browser of an admin or a user with host read permissions when they run the check on the service discovery page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with administrative privileges to inject malicious scripts that execute in the browsers of other administrators or users with host read permissions.

The impact includes potential unauthorized actions performed in the context of the victim's session, such as stealing session tokens, performing actions on behalf of the victim, or other malicious activities enabled by executing arbitrary JavaScript.

The CVSS score of 4.8 indicates a medium severity level, meaning the vulnerability poses a moderate risk.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Checkmk to a fixed version where the issue has been resolved.

• Upgrade to Checkmk version 2.5.0p5 or later.
• Upgrade to Checkmk version 2.4.0p31 or later.
• Upgrade to Checkmk version 2.3.0p48 or later.

No manual interaction or additional configuration changes are required after upgrading.

Useful 0 Not Useful 0