Werk #17994: Kubernetes: Arbitrary file write and code execution via excluded node roles
| Component | Checks & agents | ||||||
| Title | Kubernetes: Arbitrary file write and code execution via excluded node roles | ||||||
| Date | Nov 3, 2026 | ||||||
| Level | Trivial Change | ||||||
| Class | Security Fix | ||||||
| Compatibility | Compatible - no manual interaction needed | ||||||
| Checkmk versions & editions |
|
The Kubernetes special agent passed the node roles from the rule option
"Cluster resource aggregation > Exclude nodes based on their role" to its
command line without separating them from other options. A user who was
allowed to edit rules could enter a role that the agent then read as one of
its own options, including the debugging option --profile, which writes
performance profiling data to a file. With it, the user could make the agent
write files to any location writable by the site user, including an
executable Python script with content they controlled. This allowed code
execution as the site user.
The agent now receives each role as a single value. A role can no longer be
read as an option. In addition, --profile now only writes into
~/tmp/check_mk/debug and no longer puts the file path into the generated
script as code. You do not need to change your configuration.
This issue was found during internal review.
Who is Affected
All sites are affected. An attacker needs a user who may edit rules in at least one folder. By default, this includes users with the role "Normal monitoring user" who have permissions on a folder. The site does not need to monitor Kubernetes, because the attacker can create the rule.
Affected Checkmk Versions
- 2.5.0
- 2.4.0
- 2.3.0 (EOL)
Vulnerability Management
We have rated the issue with a CVSS Score of 9.4 Critical
(CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
and assigned CVE-2026-121374.