Catch up on the latest product updates, best practices, and expert insights from the Checkmk Conference #12 – Watch the livestream recordings now
back to website

Werk #22115: Fix missing authorization for viewing background jobs

Component Setup
Title Fix missing authorization for viewing background jobs
Date Aug 5, 2026
Level Trivial Change
Class Security Fix
Compatibility Compatible - no manual interaction needed
Checkmk versions & editions
3.0.0b1
Not yet released 		Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.5.0p12 Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.4.0p36 Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.3.0p50
Not yet released 		Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Ultimate MT

Missing authorization to view background jobs. An authenticated user who knows the id of a background job was able to view the results and status of that job. Some background jobs like activate changes contain randomly generated UUIDs in their ID and are unrealistic to guess, others like autodiscovery are nearly always present. In our brief testing we did not find any sensitive data in these results but it is reasonable to assume this could contain sensitive information.

Who is Affected

All editions and configurations are affected.

Affected Checkmk Versions

  • 2.5.0
  • 2.4.0
  • 2.3.0
  • 2.2.0 (EOL)

Vulnerability Management

We have rated the issue with a CVSS Score of 5.3 MEDIUM (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) and assigned CVE-2026-17548.

We thank LXY (@TA-MU-TA) and @eric-owo for reporting this issue.

To the list of all Werks