{"id":"CVE-2026-117611","kind":"vulnerability","aliases":["CVE-2026-117611"],"related":[],"title":"Checkmk: certificate validation trusts a root CA with public keys","description":"Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Certificate Authority stores bundled with \"certifi\" and \"webpki-roots\" include a root CA that trusts eMudhra (emSign) intermediate certificates whose private keys are public.","summary":"Checkmk's bundled certificate authority stores (from the certifi and webpki-roots packages) include a root CA that trusts eMudhra (emSign) intermediate certificates whose private keys are public. An attacker holding one of those certificates could impersonate a server that Checkmk connects to and be trusted.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["checkmk","infrastructure","monitoring","self-hosted"],"not_affected_if":["fixed-patch-level"],"how_to_check":"- Check the installed Checkmk version against the affected ranges, for example with `omd version` on the Checkmk site.\n- Confirm which Checkmk version line the server runs: 2.2.0, 2.3.0, 2.4.0 or 2.5.0 patch levels below the fixed releases are affected.","fix":"- Checkmk `2.5.0p18` or later\n- Checkmk `2.4.0p39` or later\n- Checkmk `2.3.0p52` or later\n- Checkmk 2.2.0 is end of life; the sources give no fixed version for it.","status":"open","published_at":"2026-10-29T10:17:03+00:00","first_seen_at":"2026-10-29T10:24:25+00:00","triaged_at":"2026-10-29T10:25:21+00:00","updated_at":"2026-10-29T10:25:21+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-29T10:25:21Z","model":"claude-haiku-5-5","output":{"fix":"- Checkmk `2.5.0p18` or later\n- Checkmk `2.4.0p39` or later\n- Checkmk `2.3.0p52` or later\n- Checkmk 2.2.0 is end of life; the sources give no fixed version for it.","reach":"network","title":"Checkmk: certificate validation trusts a root CA with public keys","impact":"medium","summary":"Checkmk's bundled certificate authority stores (from the certifi and webpki-roots packages) include a root CA that trusts eMudhra (emSign) intermediate certificates whose private keys are public. An attacker holding one of those certificates could impersonate a server that Checkmk connects to and be trusted.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["checkmk","self-hosted","monitoring"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker impersonates a trusted TLS server to Checkmk","analyst_note":"Confirm from the NVD entry or Checkmk advisory which connections are affected and whether 2.2.0 has any fix; the sources given do not describe the attack path in detail.","how_to_check":"- Check the installed Checkmk version against the affected ranges, for example with `omd version` on the Checkmk site.\n- Confirm which Checkmk version line the server runs: 2.2.0, 2.3.0, 2.4.0 or 2.5.0 patch levels below the fixed releases are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-patch-level"],"who_is_affected":"Checkmk servers in the affected version ranges that make outbound TLS connections relying on the bundled CA stores are exposed to certificate impersonation. Installations on fixed patch levels are not affected. The sources do not state which specific Checkmk connections are most exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4163,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117611':13A,16A '-2026':12A,15A '2.2.0':82C '2.3.0':79C '2.4.0':77C '2.5.0':75C 'attack':53B 'author':27B,86C 'bundl':25B,88C 'ca':7A,40B,98C 'certif':2A,26B,46B,58B,71C,85C,104C 'certifi':31B,90C 'checkmk':1A,17B,23B,64B,74C 'connect':65B 'could':59B 'cve':11A,14A 'emsign':44B,102C 'emudhra':43B,101C 'eol':83C 'hold':54B 'host':22B 'imperson':60B 'improp':70C 'includ':37B,95C 'infrastructur':18B 'intermedi':45B,103C 'key':10A,49B,107C 'monitor':19B 'one':55B 'p18':76C 'p39':78C 'p52':80C 'packag':36B 'privat':48B,106C 'public':9A,51B,109C 'root':6A,35B,39B,94C,97C 'self':21B 'self-host':20B 'server':62B 'store':28B,87C 'trust':4A,42B,69B,100C 'valid':3A,72C 'webpki':34B,93C 'webpki-root':33B,92C 'whose':47B,105C","nicknames":[],"mitigations":[],"who_affected":"Checkmk servers in the affected version ranges that make outbound TLS connections relying on the bundled CA stores are exposed to certificate impersonation. Installations on fixed patch levels are not affected. The sources do not state which specific Checkmk connections are most exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T10:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@checkmk.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117611","severity":null,"published_at":"2026-10-29T10:17:03+00:00","modified_at":"2026-10-29T10:17:03+00:00","first_seen_at":"2026-10-29T10:24:25+00:00","fetched_at":"2026-10-29T10:24:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}