CVE-2026-71862
Received Received - Intake

Checkmate Unauthenticated Credential Exposure via Status Page API

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response includes the secret field used by HttpProvider.ts as an HTTP Authorization credential, even though BaseStatusPage.tsx does not display that value, allowing visitors to extract credentials from the JSON response and use them against monitored services. This issue is fixed in version 3.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-71862
EUVD
EUVD-2026-64039

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
checkmate checkmate From 3.3.0 (inc) to 3.9.2 (inc)
bluewave-labs checkmate 3.3.0
bluewave-labs checkmate 3.4.0
bluewave-labs checkmate 3.5.0
bluewave-labs checkmate 3.6.0
bluewave-labs checkmate 3.7.0
bluewave-labs checkmate 3.8.0
bluewave-labs checkmate From 3.3.0 (inc) to 3.9.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Checkmate (versions 3.3.0 to 3.9.2) occurs when the global showURL setting is enabled. It allows unauthenticated users to access the GET /api/v1/status-page/:url endpoint, which returns complete monitor objects including sensitive secret fields used for HTTP Authorization. These secrets can be extracted from the JSON response and misused against monitored services.

Detection Guidance

Check for unauthenticated access to the /api/v1/status-page/:url endpoint by inspecting network traffic or logs for GET requests to this path. Verify if the showURL setting is enabled in your Checkmate configuration. Examine API responses for the secret field in monitor objects.

Impact Analysis

Attackers can steal authentication credentials used by Checkmate to monitor HTTP endpoints. This may lead to unauthorized access to monitored services, potential lateral movement within networks, or compromise of cloud services. The impact depends on the privileges of the exposed credentials.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive authentication credentials. GDPR may consider this a breach of personal data protection, while HIPAA could view it as a compromise of protected health information access controls. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Upgrade Checkmate to version 3.9.2 or later. If upgrading is not immediately possible, disable the showURL setting in your Checkmate configuration until patched. Monitor for unauthorized access to monitored services using exposed credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71862. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart