CVE-2026-103674 · Package
NO FIX YET · SEE WHAT TO DO
Checkmk's NetApp ONTAP special agent passes the login password on its command line, so it is visible while the agent runs. A local user on the Checkmk server can read the NetApp password from the process list.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Checkmk 2.5.0 before 2.5.0p16 that monitor NetApp ONTAP storage with the special agent. A local user on the Checkmk server is needed to read the password, and both configured and password-store credentials are affected. Installations that do not monitor NetApp ONTAP, or where only trusted administrators have shell access to the server, have lower exposure.
Not affected if no-netapp-ontap-monitoring, single-admin-server
Who cares checkmk, netapp-ontap, self-hosted
omd version on a site, and compare it against 2.5.0p16.2.5.0p16 or later, per the affected range 2.5.0 before 2.5.0p16.Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the NetApp login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.