CVE-2026-118965 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Checkmk's discovered host label synchronization has a path traversal flaw. An attacker who controls a remote site in a distributed monitoring setup can write arbitrary files on the central site and execute code as the central site user.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Exposure requires a distributed monitoring setup where a remote site is connected to a central Checkmk site. The attacker must control a remote site, so single-site installations without remote sites are less exposed. Teams running only standalone sites can deprioritize, but should still confirm the version.
Not affected if fixed-version-installed, single-site-only
Who cares checkmk, distributed-monitoring, self-hosted
omd version and compare it to the fixed versions below.2.5.0p19 or later2.4.0p40 or laterPath traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an attacker in control of a remote site in a distributed monitoring setup to write arbitrary files on the central site and thereby execute code as the central site user.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.