CVE-2026-121374 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The Kubernetes special agent in Checkmk builds command arguments from node roles in the "Exclude nodes based on their role" rule option without sanitizing them. A user who can edit rules in at least one folder can write files to any location the site user can write to, which leads to code execution as the site user.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only installations that run the Kubernetes special agent and let users edit rules are exposed. An attacker needs an account with rule-editing permission in at least one folder. Installations without the Kubernetes agent or without such users are less exposed.
Not affected if auth-required, no-kubernetes-agent
Who cares checkmk, kubernetes, self-hosted
2.5.0p19, 2.4.0p40, and 2.3.0 which is end of life).2.5.0p19 or later.2.4.0p40 or later.Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in the "Exclude nodes based on their role" rule option, leading to code execution as the site user.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.