---
id: "CVE-2026-103674"
page: "https://infrastack.ai/live/CVE-2026-103674"
kind: "vulnerability"
aliases: ["CVE-2026-103674"]
title: "Checkmk: NetApp ONTAP agent exposes login password in process list"
severity: "low"
cvss: 2.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["checkmk", "netapp-ontap", "package", "self-hosted"]
not_affected_if: ["no-netapp-ontap-monitoring", "single-admin-server"]
published_at: "2026-11-06T09:16:58+00:00"
first_seen_at: "2026-11-06T09:40:32+00:00"
updated_at: "2026-11-06T09:40:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103674", "first_seen_at": "2026-11-06T09:40:32+00:00"}]
exploit_sources: []
---

# Checkmk: NetApp ONTAP agent exposes login password in process list

Link for people: https://infrastack.ai/live/CVE-2026-103674 (this .md is for agents)

Checkmk's NetApp ONTAP special agent passes the login password on its command line, so it is visible while the agent runs. A local user on the Checkmk server can read the NetApp password from the process list.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Checkmk version, for example with `omd version` on a site, and compare it against `2.5.0p16`.
- Look for use of the NetApp ONTAP special agent in your monitoring configuration.

## Fix

- Checkmk `2.5.0p16` or later, per the affected range `2.5.0` before `2.5.0p16`.

## Timeline

- 2026-11-06T09:40:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103674

## From the sources

Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the NetApp login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_