{"id":"CVE-2026-103682","kind":"vulnerability","aliases":["CVE-2026-103682"],"related":[],"title":"Checkmk: Jolokia login password visible in process list on server","description":"Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the Jolokia login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.","summary":"Checkmk's Jolokia special agent receives its login password on the command line, so it appears in the process list while the agent runs. A local user on the Checkmk server can read that password, whether it was set directly or taken from the password store.","severity":"low","cvss":2.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["checkmk","infrastructure","local-users","self-hosted"],"not_affected_if":["no-jolokia-agent","no-local-users","version-2.5.0p16-or-later"],"how_to_check":"- Check the installed Checkmk version (for example with `omd version` on the site) and see whether it is in the `2.5.0` range before `2.5.0p16`.\n- While a Jolokia check runs, list processes (for example `ps aux | grep jolokia`) and see whether the password is visible in the arguments.","fix":"- Checkmk `2.5.0p16` or later, per the affected range in the description.","status":"open","published_at":"2026-11-06T09:16:59+00:00","first_seen_at":"2026-11-06T09:40:32+00:00","triaged_at":"2026-11-06T09:40:50+00:00","updated_at":"2026-11-06T09:40:50+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-06T09:40:50Z","model":"claude-haiku-5-5","output":{"fix":"- Checkmk `2.5.0p16` or later, per the affected range in the description.","reach":"local","title":"Checkmk: Jolokia login password visible in process list on server","impact":"low","summary":"Checkmk's Jolokia special agent receives its login password on the command line, so it appears in the process list while the agent runs. A local user on the Checkmk server can read that password, whether it was set directly or taken from the password store.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["checkmk","self-hosted","local-users"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"local user reads Jolokia login password from process list","analyst_note":"","how_to_check":"- Check the installed Checkmk version (for example with `omd version` on the site) and see whether it is in the `2.5.0` range before `2.5.0p16`.\n- While a Jolokia check runs, list processes (for example `ps aux | grep jolokia`) and see whether the password is visible in the arguments.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.5.0p16-or-later","no-jolokia-agent","no-local-users"],"who_is_affected":"Only Checkmk servers running version 2.5.0 before 2.5.0p16 that use the Jolokia special agent are exposed. The attacker must already be a local user on the Checkmk server; remote attackers without a local account are not described as affected. Teams on later patch levels or without Jolokia monitoring can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000705,"input_tokens":4230,"output_tokens":563,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-103682':13A,16A '-2026':12A,15A '2.5.0':88C,90C 'affect':117C 'agent':29B,47B,76C,113C 'allow':92C 'appear':40B 'checkmk':1A,17B,25B,54B,86C,98C 'command':36B,83C 'configur':120C 'cve':11A,14A 'direct':64B 'explicit':119C 'host':24B 'infrastructur':18B 'invoc':71C 'jolokia':2A,27B,74C,103C 'line':37B,84C 'list':8A,44B,109C 'local':20B,50B,94C 'local-us':19B 'login':3A,32B,79C,104C 'p16':91C 'password':4A,33B,59B,69B,80C,105C,121C,123C,126C 'process':7A,43B,108C 'read':57B,101C 'receiv':30B 'run':48B,115C 'self':23B 'self-host':22B 'server':10A,55B,99C 'set':63B 'special':28B,75C,112C 'store':70B,127C 'taken':66B 'user':21B,51B,95C 'version':87C 'visibl':5A 'whether':60B","nicknames":[],"mitigations":[],"who_affected":"Only Checkmk servers running version 2.5.0 before 2.5.0p16 that use the Jolokia special agent are exposed. The attacker must already be a local user on the Checkmk server; remote attackers without a local account are not described as affected. Teams on later patch levels or without Jolokia monitoring can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["checkmk","infrastructure","localusers","low","selfhosted"],"campaign_type":null,"search_a":"'-103682':13A,16A '-2026':12A,15A 'checkmk':1A 'cve':11A,14A 'jolokia':2A 'list':8A 'login':3A 'password':4A 'process':7A 'server':10A 'visibl':5A","search_b":"'agent':29B,47B 'appear':40B 'checkmk':17B,25B,54B 'command':36B 'direct':64B 'host':24B 'infrastructur':18B 'jolokia':27B 'line':37B 'list':44B 'local':20B,50B 'local-us':19B 'login':32B 'password':33B,59B,69B 'process':43B 'read':57B 'receiv':30B 'run':48B 'self':23B 'self-host':22B 'server':55B 'set':63B 'special':28B 'store':70B 'taken':66B 'user':21B,51B 'whether':60B","search_c":"'2.5.0':88C,90C 'affect':117C 'agent':76C,113C 'allow':92C 'checkmk':86C,98C 'command':83C 'configur':120C 'explicit':119C 'invoc':71C 'jolokia':74C,103C 'line':84C 'list':109C 'local':94C 'login':79C,104C 'p16':91C 'password':80C,105C,121C,123C,126C 'process':108C 'read':101C 'run':115C 'server':99C 'special':75C,112C 'store':127C 'user':95C 'version':87C","first_public_at":"2026-11-06T09:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@checkmk.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103682","severity":null,"published_at":"2026-11-06T09:16:59+00:00","modified_at":"2026-11-06T09:16:59+00:00","first_seen_at":"2026-11-06T09:40:32+00:00","fetched_at":"2026-11-06T09:40:32+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}