Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-33456

Potential livestatus injection in notification test

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Checkmk

Description

Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via a crafted service description.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Checkmk GmbH Checkmk

Default version status: unaffected

  • 2.5.0 to < 2.5.0b4affected
  • 2.4.0 to < 2.4.0p26affected

References