Werk #17989: Potential livestatus injection in notification test mode

Component

Notifications

Title

Potential livestatus injection in notification test mode

Date

Mar 23, 2026

Level

Trivial Change

Class

Security Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

2.6.0b1 Not yet released	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.5.0b4	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.4.0p26	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT

Prior to this fix, the notification test mode did not properly sanitize the user-supplied service description value before interpolating it into a Livestatus query. This allowed an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via a crafted service description in the test context.

This issue was found during internal review.

Affected Versions:

2.5.0
2.4.0

Vulnerability Management:

We have rated the issue with a CVSS score of 5.1 (Medium) with the following CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N, and assigned CVE-2026-33456.

To the list of all Werks