Werk #19604: Fix Livestatus injection via monitoring filter values
| Component | User interface | ||||
| Title | Fix Livestatus injection via monitoring filter values | ||||
| Date | Sep 4, 2026 | ||||
| Level | Trivial Change | ||||
| Class | Security Fix | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
The monitoring host and service list APIs did not safely handle filter values when constructing Livestatus queries. An authenticated user could inject additional Livestatus query headers through a crafted filter value.
This allowed the user to bypass normal object visibility restrictions in count queries and infer information about hosts or services outside their assigned contact groups. Injecting Livestatus wait headers could also keep web server and Livestatus workers occupied for an attacker-controlled duration.
Filter values are now handled without introducing additional Livestatus headers or request boundaries.
Who is Affected
All editions and configurations are affected.
Affected Checkmk Versions
- 2.5.0
Vulnerability Management
We have rated the issue with a CVSS Score of 5.3 / Medium (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) and assigned CVE-2026-90990.
This issue was found by internal review.