Werk #20174: Agent receiver: reject mTLS requests without a client certificate
| Component | Core & setup | ||||
| Title | Agent receiver: reject mTLS requests without a client certificate | ||||
| Date | Jul 16, 2026 | ||||
| Level | Trivial Change | ||||
| Class | Security Fix | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
Previously, the agent receiver accepted requests to its mTLS-protected endpoints even when the caller presented no client certificate. When no certificate was provided, the worker injected a fixed placeholder identity, and a caller who supplied that placeholder value in the request URL could satisfy the mutual-TLS check without ever authenticating with a certificate. This affected relay endpoints in particular, where the placeholder could be used in place of a relay ID.
This has been fixed. The agent receiver now injects a verified identity only when a valid client certificate is present, strips any client-supplied copy of the internal identity header, and rejects any request to an mTLS-protected endpoint that arrives without a verified certificate. Such requests now receive a clear "No verified client certificate provided" response.
Legitimate agents and relays already authenticate with their client certificates, so no reconfiguration is required after updating.
Who's Affected:
This issue affects the Checkmk cloud, ultimate, and ultimatemt editions, which provide the relay feature. Other editions do not expose the affected relay endpoints.
Affected Versions:
- 2.5.0
Vulnerability Management:
We have rated the issue with a CVSS Score of 6.9 Medium (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N) and assigned CVE-2026-15576.