---
id: "CVE-2026-121374"
page: "https://infrastack.ai/live/CVE-2026-121374"
kind: "vulnerability"
aliases: ["CVE-2026-121374"]
title: "Checkmk: Kubernetes agent argument injection lets rule editors run code"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["checkmk", "infrastructure", "kubernetes", "self-hosted"]
not_affected_if: ["auth-required", "no-kubernetes-agent"]
published_at: "2026-11-11T11:17:14+00:00"
first_seen_at: "2026-11-11T11:26:55+00:00"
updated_at: "2026-11-11T11:27:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121374", "first_seen_at": "2026-11-11T11:26:55+00:00"}]
exploit_sources: []
---

# Checkmk: Kubernetes agent argument injection lets rule editors run code

Link for people: https://infrastack.ai/live/CVE-2026-121374 (this .md is for agents)

The Kubernetes special agent in Checkmk builds command arguments from node roles in the "Exclude nodes based on their role" rule option without sanitizing them. A user who can edit rules in at least one folder can write files to any location the site user can write to, which leads to code execution as the site user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Checkmk version against the affected ranges (`2.5.0p19`, `2.4.0p40`, and 2.3.0 which is end of life).
- Review who has permission to edit rules in Checkmk folders and whether the Kubernetes special agent is in use.

## Fix

- Upgrade Checkmk 2.5.x to `2.5.0p19` or later.
- Upgrade Checkmk 2.4.x to `2.4.0p40` or later.
- Checkmk 2.3.0 is end of life; the sources state no fixed version for it.

## Timeline

- 2026-11-11T11:26:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121374

## From the sources

Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in the "Exclude nodes based on their role" rule option, leading to code execution as the site user.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_