Werk #22429: NetApp: Hide the password from the process list and accept passwords that start with a dash
| Component | Checks & agents | ||||
| Title | NetApp: Hide the password from the process list and accept passwords that start with a dash | ||||
| Date | Sep 30, 2026 | ||||
| Level | Trivial Change | ||||
| Class | Security Fix | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
The NetApp special agent received the password in plain text on its command
line. Any user who could list the processes on the Checkmk server, for example
with ps, could read the password while the agent ran. This applied both to
explicit passwords and to passwords from the password store.
The same command line also caused a functional problem. If the password
started with a dash (-), the agent stopped with the error
argument --password: expected one argument and fetched no data.
The special agent now reads the password from the password store. The password no longer appears on the command line, and it can start with any character. You do not need to change your configuration.
This issue was found during internal review.
Who is Affected
All editions that monitor NetApp ONTAP with the special agent.
Affected Checkmk Versions
- 2.5.0
Vulnerability Management
We have rated the issue with a CVSS Score of LOW
(CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L 2.1 LOW)
and assigned CVE-2026-103674.