CVE-2026-103682 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Checkmk's Jolokia special agent receives its login password on the command line, so it appears in the process list while the agent runs. A local user on the Checkmk server can read that password, whether it was set directly or taken from the password store.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only Checkmk servers running version 2.5.0 before 2.5.0p16 that use the Jolokia special agent are exposed. The attacker must already be a local user on the Checkmk server; remote attackers without a local account are not described as affected. Teams on later patch levels or without Jolokia monitoring can skip it.
Not affected if no-jolokia-agent, no-local-users, version-2.5.0p16-or-later
Who cares checkmk, local-users, self-hosted
omd version on the site) and see whether it is in the 2.5.0 range before 2.5.0p16.ps aux | grep jolokia) and see whether the password is visible in the arguments.2.5.0p16 or later, per the affected range in the description.Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the Jolokia login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.