Catch up on the latest product updates, best practices, and expert insights from the Checkmk Conference #12 – Watch the livestream recordings now
back to website

Werk #13721: Stop returning password hashes over WebAPI

Component Setup
Title Stop returning password hashes over WebAPI
Date Feb 15, 2022
Level Trivial Change
Class Security Fix
Compatibility Incompatible - Manual interaction might be required
Checkmk versions & editions
2.1.0b1 Checkmk Community, Checkmk Pro, Checkmk Ultimate MT
2.0.0p21 Checkmk Community, Checkmk Pro, Checkmk Ultimate MT

Previous to this Werk the WebAPI returned the password hashes and SessionIds when calling the get_all_users action. If the user was a automation user the password was returned in clear-text.

This data should not be returned ever. If you forgot a password you have to reset it.

To the list of all Werks