Werk #22314: Fix open redirect and XSS via reset_url parameter
| Component | Setup | ||||||||
| Title | Fix open redirect and XSS via reset_url parameter | ||||||||
| Date | Sep 2, 2026 | ||||||||
| Level | Trivial Change | ||||||||
| Class | Security Fix | ||||||||
| Compatibility | Compatible - no manual interaction needed | ||||||||
| Checkmk versions & editions |
|
The Setup search bar's Reset button, and the empty-search submit path, built their target URL from the reset_url query parameter without validating its scheme or origin. An attacker could craft a Setup search URL with a malicious reset_url: a javascript: value executed arbitrary script in the victim's session when they clicked the Reset button or submitted an empty search, and an absolute value pointing at another origin caused an open redirect. Exploitation is one-click and requires the victim to have Setup access.
This issue has now been fixed by restricting reset_url to same-origin relative URLs.
This issue was found during internal review.
Who's Affected
All editions of Checkmk are affected, on any page that uses the in-page search (PageMenuSearch) and requires Setup access to exploit.
Affected Versions
- 2.5.0
- 2.4.0
- 2.3.0
- 2.2.0 (EOL)
Indicators of Compromise
Requests containing a suspicious reset_url value, for example a javascript: scheme or a foreign host, may be visible in the web server's access log.
Vulnerability Management
We have rated the issue with a CVSS Score of 8.6 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N) and assigned CVE-2026-14452.
Though the CVSS score is high, we deem this vulnerability to be of medium severity.