Werk #22305: Fix CSRF validation on background job actions

Component

Setup

Title

Fix CSRF validation on background job actions

Date

Oct 14, 2026

Level

Trivial Change

Class

Security Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

3.0.0b1 Not yet released	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.5.0p16	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.4.0p39	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.3.0p52	Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Ultimate MT

Before this fix, the stop, delete and acknowledge actions for background jobs did not validate the CSRF token.

An attacker could trick an authenticated user into visiting a malicious link, which would then stop or delete background jobs (for example, service discovery or activate changes) on behalf of that user.

The endpoints were not covered by the fix for CVE-2024-28828 (Werk #17090). These actions now require a valid CSRF token.

We thank koalarajin for reporting this issue.

Who is Affected

This issue affects all editions of Checkmk in the default configuration.

Affected Checkmk Versions

2.5.0
2.4.0
2.3.0
2.2.0 (EOL)

Vulnerability Management

We have rated the issue with a CVSS Score of 2.3 Low (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N) and assigned CVE-2026-110511.

To the list of all Werks