{"id":"CVE-2026-103674","kind":"vulnerability","aliases":["CVE-2026-103674"],"related":[],"title":"Checkmk: NetApp ONTAP agent exposes login password in process list","description":"Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the NetApp login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.","summary":"Checkmk's NetApp ONTAP special agent passes the login password on its command line, so it is visible while the agent runs. A local user on the Checkmk server can read the NetApp password from the process list.","severity":"low","cvss":2.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["checkmk","netapp-ontap","package","self-hosted"],"not_affected_if":["no-netapp-ontap-monitoring","single-admin-server"],"how_to_check":"- Check the installed Checkmk version, for example with `omd version` on a site, and compare it against `2.5.0p16`.\n- Look for use of the NetApp ONTAP special agent in your monitoring configuration.","fix":"- Checkmk `2.5.0p16` or later, per the affected range `2.5.0` before `2.5.0p16`.","status":"open","published_at":"2026-11-06T09:16:58+00:00","first_seen_at":"2026-11-06T09:40:32+00:00","triaged_at":"2026-11-06T09:40:51+00:00","updated_at":"2026-11-06T09:40:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T09:40:51Z","model":"claude-haiku-5-5","output":{"fix":"- Checkmk `2.5.0p16` or later, per the affected range `2.5.0` before `2.5.0p16`.","reach":"local","title":"Checkmk: NetApp ONTAP agent exposes login password in process list","impact":"medium","summary":"Checkmk's NetApp ONTAP special agent passes the login password on its command line, so it is visible while the agent runs. A local user on the Checkmk server can read the NetApp password from the process list.","audience":"businesses","category":"package","nicknames":[],"who_cares":["checkmk","netapp-ontap","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"local user reads NetApp ONTAP login password from process list","analyst_note":"","how_to_check":"- Check the installed Checkmk version, for example with `omd version` on a site, and compare it against `2.5.0p16`.\n- Look for use of the NetApp ONTAP special agent in your monitoring configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["no-netapp-ontap-monitoring","single-admin-server"],"who_is_affected":"Teams running Checkmk 2.5.0 before 2.5.0p16 that monitor NetApp ONTAP storage with the special agent. A local user on the Checkmk server is needed to read the password, and both configured and password-store credentials are affected. Installations that do not monitor NetApp ONTAP, or where only trusted administrators have shell access to the server, have lower exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000705,"input_tokens":4233,"output_tokens":563,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-103674':13A,16A '-2026':12A,15A '2.5.0':81C,83C 'affect':110C 'agent':4A,30B,45B,69C,106C 'allow':85C 'checkmk':1A,17B,25B,52B,79C,91C 'command':37B,76C 'configur':113C 'cve':11A,14A 'explicit':112C 'expos':5A 'host':24B 'invoc':63C 'line':38B,77C 'list':10A,62B,102C 'local':48B,87C 'login':6A,33B,72C,97C 'netapp':2A,19B,27B,57B,66C,96C 'netapp-ontap':18B 'ontap':3A,20B,28B,67C 'p16':84C 'packag':21B 'pass':31B 'password':7A,34B,58B,73C,98C,114C,116C,119C 'process':9A,61B,101C 'read':55B,94C 'run':46B,108C 'self':23B 'self-host':22B 'server':53B,92C 'special':29B,68C,105C 'store':120C 'user':49B,88C 'version':80C 'visibl':42B","nicknames":[],"mitigations":[],"who_affected":"Teams running Checkmk 2.5.0 before 2.5.0p16 that monitor NetApp ONTAP storage with the special agent. A local user on the Checkmk server is needed to read the password, and both configured and password-store credentials are affected. Installations that do not monitor NetApp ONTAP, or where only trusted administrators have shell access to the server, have lower exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["checkmk","low","netappontap","package","selfhosted"],"campaign_type":null,"search_a":"'-103674':13A,16A '-2026':12A,15A 'agent':4A 'checkmk':1A 'cve':11A,14A 'expos':5A 'list':10A 'login':6A 'netapp':2A 'ontap':3A 'password':7A 'process':9A","search_b":"'agent':30B,45B 'checkmk':17B,25B,52B 'command':37B 'host':24B 'line':38B 'list':62B 'local':48B 'login':33B 'netapp':19B,27B,57B 'netapp-ontap':18B 'ontap':20B,28B 'packag':21B 'pass':31B 'password':34B,58B 'process':61B 'read':55B 'run':46B 'self':23B 'self-host':22B 'server':53B 'special':29B 'user':49B 'visibl':42B","search_c":"'2.5.0':81C,83C 'affect':110C 'agent':69C,106C 'allow':85C 'checkmk':79C,91C 'command':76C 'configur':113C 'explicit':112C 'invoc':63C 'line':77C 'list':102C 'local':87C 'login':72C,97C 'netapp':66C,96C 'ontap':67C 'p16':84C 'password':73C,98C,114C,116C,119C 'process':101C 'read':94C 'run':108C 'server':92C 'special':68C,105C 'store':120C 'user':88C 'version':80C","first_public_at":"2026-11-06T09:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@checkmk.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103674","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103674","severity":null,"published_at":"2026-11-06T09:16:58+00:00","modified_at":"2026-11-06T09:16:59+00:00","first_seen_at":"2026-11-06T09:40:32+00:00","fetched_at":"2026-11-06T09:40:32+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}