Catch up on the latest product updates, best practices, and expert insights from the Checkmk Conference #12 – Watch the livestream recordings now
back to website

Werk #20077: Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses

Component REST API
Title Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses
Date May 27, 2026
Level Trivial Change
Class Security Fix
Compatibility Incompatible - Manual interaction might be required
Checkmk versions & editions
3.0.0b1
Not yet released 		Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.5.0p15 Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.4.0p38
Not yet released 		Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.3.0p51
Not yet released 		Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Ultimate MT

GET requests to the host and folder configuration endpoints of the REST API returned stored secrets in clear text:

  • snmp_community -- the SNMP v1/v2 community string and the SNMPv3 auth_password and privacy_password pass phrases
  • management_snmp_community -- the same fields for the management board
  • management_ipmi_credentials -- the IPMI password

The setup GUI never shows these values, not even to an administrator. The REST API did not follow that principle, so any user permitted to view a host's configuration could read them back -- an account with the built-in "user" role that is a contact for the host is sufficient.

These fields are now omitted from GET responses. The surrounding non-secret fields (type, auth_protocol, security_name, privacy_protocol, IPMI username, ...) are still returned, so clients can still tell which kind of credential is configured. The fields remain mandatory when creating or updating a host, which is why this werk is incompatible: a client that reads a host's configuration and sends it back unchanged now receives "Missing SNMPv3 pass phrase(s)" and must supply the credentials explicitly.

Affected Checkmk Versions

  • 2.5.0
  • 2.4.0
  • 2.3.0
  • 2.2.0 (EOL)

Vulnerability Management

We have rated the issue with a CVSS Score of 2.3 Low (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L) and assigned CVE-2026-92882.

To the list of all Werks