Werk #19372: Multi-tenancy: trusted CA certificates were distributed to all remote sites
| Component | Setup | ||||||
| Title | Multi-tenancy: trusted CA certificates were distributed to all remote sites | ||||||
| Date | Sep 3, 2026 | ||||||
| Level | Trivial Change | ||||||
| Class | Security Fix | ||||||
| Compatibility | Incompatible - Manual interaction might be required | ||||||
| Checkmk versions & editions |
|
The Trusted certificate authorities for SSL global setting (Setup > General > Global settings > Site management) is the trust store every server component of a site uses for its outgoing HTTPS connections.
Issue
In a distributed setup with multi-tenancy, every remote site received the certificates Manually added to this setting on the central site, regardless of the customer it belongs to. A CA that one customer administers was therefore trusted by the sites of every other customer.
Background
Multi-tenancy keeps this setting on the central site by design; it is documented as not being distributed. The configuration snapshot did exclude the file holding the certificates, but then regenerated the global settings of all configuration domains from the full central configuration, which wrote it back in.
Solution
Only the settings of the GUI configuration domain are regenerated now. Remote sites no longer receive the certificates, and a site that already holds them is cleaned up with the next activation of changes.
What you have to do
A remote site that relied on a centrally added CA loses it, and then trusts only the system wide CAs of its host plus its own site specific global settings. Add such a CA under Setup > Distributed monitoring, Site specific global settings of the site that needs it — the supported place for customer specific CAs, and for the central site itself if it has to trust a single remote site. If you had unticked Trust system wide configured CAs centrally, untick it there as well.
Who's Affected:
Distributed setups of Checkmk Ultimate with multi-tenancy that have manually added CA certificates on the central site. Setups using only Trust system wide configured CAs are not affected.
Affected Versions:
- 2.4.0p12 onwards
Mitigations:
If updating is not possible, remove the manually added certificates from the global setting and add them to the site specific global settings of the sites that need them.
Vulnerability Management:
We have rated the issue with a CVSS Score of 2.3 Low
(CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N) and
assigned CVE-2026-92878.