Werk #22153: Fix monitoring data injection via mk-job job files
| Component | Checks & agents | ||||||||
| Title | Fix monitoring data injection via mk-job job files | ||||||||
| Date | Sep 17, 2026 | ||||||||
| Level | Trivial Change | ||||||||
| Class | Security Fix | ||||||||
| Compatibility | Compatible - no manual interaction needed | ||||||||
| Checkmk versions & editions |
|
The agent's job section copied the content of every file below $MK_VARDIR/job/<user>/ into
the agent output unchanged. Those files are written by the user that ran the job, so a user
with write access to such a directory could place lines that the Checkmk server reads as
markers rather than as job data:
<<<section>>>added or replaced an arbitrary agent section for the host.<<<<hostname>>>>opened a piggyback block, so the sections following it in the agent output were delivered as another host's monitoring data instead of this host's.<<<>>>and<<<<>>>>ended the job section early, dropping every job the agent reported after it - in practice the jobs of other users.==> name <==started a new job entry, letting one file impersonate any job on the host.
The agent now escapes these markers while reading a job file, so job file content can no longer be anything but job data.
Creating the per-user job directory requires root, so only users for whom job monitoring has been set up are in a position to exploit this.
Who is Affected
All editions, on Linux, AIX, Solaris, FreeBSD and OpenWrt, wherever job monitoring is set up for a user other than root. The Windows agent is not affected.
Affected Checkmk Versions
- 2.5.0
- 2.4.0
- 2.3.0
- 2.2.0 (EOL)
Vulnerability Management
We have rated the issue with a CVSS Score of 2.0 Low (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) and assigned CVE-2026-84112.
This issue was found during internal review.