Werk #22192: Relays could submit monitoring data for hosts they do not monitor
| Component | Core & setup | ||
| Title | Relays could submit monitoring data for hosts they do not monitor | ||
| Date | Oct 12, 2026 | ||
| Level | Trivial Change | ||
| Class | Security Fix | ||
| Compatibility | Compatible - no manual interaction needed | ||
| Checkmk versions & editions |
|
The Checkmk Micro Core accepts monitoring data that a Checkmk Relay submits via the agent receiver of the site. Each submission names the host, and optionally the service, the data belongs to. The core resolved that name against its configuration, but did not check that the host is monitored by the relay which submitted the data. A registered relay could therefore submit data for any host or service known to the site, including hosts monitored by another relay and hosts the site monitors itself. This applies to both kinds of submitted data: raw agent output, which is processed as if it had been fetched from the host and thus feeds check results, metrics and inventory, and check results, which set the state and output of a host or service directly. The consequence is forged monitoring data for arbitrary hosts, which can raise spurious alerts and notifications or mask real ones.
The agent receiver now passes the identity of the submitting relay, as
verified by its client certificate, on to the core. The core accepts the data
only if the target host is monitored by exactly this relay, as configured in
the host attribute Monitored on relay. It rejects all other submissions and
logs them in var/log/cmc.log; the relay itself is not notified. Relays do
not need to be updated.
Who is Affected
Sites which monitor hosts via a Checkmk Relay. Exploitation requires the client certificate of a registered relay, since the agent receiver only accepts monitoring data from relays authenticated via mutual TLS. Sites without a registered relay are not affected.
Affected Checkmk Versions
- 2.5.0
Vulnerability Management
We have rated the issue with a CVSS Score of 5.3 (Medium) (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) and assigned CVE-2026-15938.
This vulnerability was identified in a commissioned penetration test conducted by PS Positive Security GmbH.