Werk #22305: Fix CSRF validation on background job actions
| Component | Setup | ||||||||
| Title | Fix CSRF validation on background job actions | ||||||||
| Date | Oct 14, 2026 | ||||||||
| Level | Trivial Change | ||||||||
| Class | Security Fix | ||||||||
| Compatibility | Compatible - no manual interaction needed | ||||||||
| Checkmk versions & editions |
|
Before this fix, the stop, delete and acknowledge actions for background jobs did not validate the CSRF token.
An attacker could trick an authenticated user into visiting a malicious link, which would then stop or delete background jobs (for example, service discovery or activate changes) on behalf of that user.
The endpoints were not covered by the fix for CVE-2024-28828 (Werk #17090). These actions now require a valid CSRF token.
We thank koalarajin for reporting this issue.
Who is Affected
This issue affects all editions of Checkmk in the default configuration.
Affected Checkmk Versions
- 2.5.0
- 2.4.0
- 2.3.0
Vulnerability Management
We have rated the issue with a CVSS Score of 2.3 Low (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N) and assigned CVE-2026-110511.