---
id: "CVE-2026-103682"
page: "https://infrastack.ai/live/CVE-2026-103682"
kind: "vulnerability"
aliases: ["CVE-2026-103682"]
title: "Checkmk: Jolokia login password visible in process list on server"
severity: "low"
cvss: 2.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["checkmk", "infrastructure", "local-users", "self-hosted"]
not_affected_if: ["no-jolokia-agent", "no-local-users", "version-2.5.0p16-or-later"]
published_at: "2026-11-06T09:16:59+00:00"
first_seen_at: "2026-11-06T09:40:32+00:00"
updated_at: "2026-11-06T09:40:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103682", "first_seen_at": "2026-11-06T09:40:32+00:00"}]
exploit_sources: []
---

# Checkmk: Jolokia login password visible in process list on server

Link for people: https://infrastack.ai/live/CVE-2026-103682 (this .md is for agents)

Checkmk's Jolokia special agent receives its login password on the command line, so it appears in the process list while the agent runs. A local user on the Checkmk server can read that password, whether it was set directly or taken from the password store.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Checkmk version (for example with `omd version` on the site) and see whether it is in the `2.5.0` range before `2.5.0p16`.
- While a Jolokia check runs, list processes (for example `ps aux | grep jolokia`) and see whether the password is visible in the arguments.

## Fix

- Checkmk `2.5.0p16` or later, per the affected range in the description.

## Timeline

- 2026-11-06T09:40:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103682

## From the sources

Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the Jolokia login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_