Werk #19735: Fixed agent receiver certificate confusion
| Component | Relay | ||||
| Title | Fixed agent receiver certificate confusion | ||||
| Date | Jul 17, 2026 | ||||
| Level | Trivial Change | ||||
| Class | Security Fix | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
A relay and an agent that share the same UUID could reuse the same mTLS certificate against any agent receiver endpoint. Normally, an agent's certificate cannot authenticate to an endpoint reserved for a relay.
We fixed this by checking each certificate's issuer against the endpoint it authenticates to, so every endpoint now trusts only its own root certificate.
Who is Affected
This affects you if you run a relay and have registered push agents whose UUID happens to match the relay's UUID.
Affected Checkmk Versions
- 2.5.0
Vulnerability Management
We have rated the issue with a CVSS Score of 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N and assigned CVE-2026-15937.
This vulnerability was identified in a commissioned penetration test conducted by PS Positive Security GmbH.