CVE-2026-9549: Stored XSS in Checkmk Service Discovery – Patch Guidance

Technical summary

This is a stored XSS vulnerability (CWE-79) affecting Checkmk's service discovery workflow. The vulnerability exists because user-supplied input from active check and custom check configurations is not properly sanitized before being displayed in the service discovery page output. An authenticated administrator can craft malicious check output that includes JavaScript payloads. When another authenticated user (admin or host-read-capable user) accesses the service discovery page to run or view checks, the stored payload executes in their browser context. The vulnerability requires high privilege (administrator role) to inject the payload and user interaction (viewing the service discovery page), limiting the attack surface but not eliminating the risk in multi-user environments.

Business impact

Organizations running vulnerable Checkmk deployments face session hijacking, credential theft, and privilege escalation risks. A malicious or compromised administrator account can inject payloads that harvest session tokens or perform actions on behalf of other users. In environments with shared administrative responsibilities, this creates lateral movement and persistence opportunities. Additionally, this vulnerability could be exploited by an insider with check configuration permissions to compromise monitoring operations and exfiltrate sensitive host or check data visible to affected users. The impact is confined to authenticated contexts but could undermine trust in the monitoring platform itself.

Affected systems

Vulnerable versions include Checkmk 2.5.0 (before patch 5), 2.4.0 (before patch 31), 2.3.0 (before patch 48), and all releases in the 2.2.0 branch. The vulnerability is present across all instances where active or custom check configuration is exposed to administrators. Verify your current version and patch level against the vendor's official release notes to confirm whether your deployment is affected.

Exploitability

The vulnerability requires administrative credentials to configure the malicious check, placing it in a privileged attack path. However, the execution occurs automatically when any authorized user views the affected service discovery page, meaning no additional social engineering or user manipulation is necessary beyond the initial compromise of an admin account. The barrier to exploitation is high privilege plus low complexity, but the reach extends to all users who interact with service discovery—making it impactful in multi-admin or shared-responsibility environments.

Remediation

Upgrade Checkmk to patched versions: 2.5.0p5 or later, 2.4.0p31 or later, 2.3.0p48 or later, or transition off the 2.2.0 branch entirely (no patch available for 2.2.0). If immediate patching is not possible, restrict administrator role assignments to trusted personnel only and audit active check and custom check configurations for suspicious or unexpected content. Review logs and service discovery output history for signs of injected HTML or JavaScript.

Patch guidance

Checkmk provides cumulative security patches. Download and apply the latest available patch for your current major.minor version from the Checkmk vendor portal. For 2.2.0 users, upgrading to at least 2.3.0p48 is required. Test patches in a non-production environment first to ensure compatibility with custom checks and monitoring workflows. Document the patch version after deployment to support compliance tracking.

Detection guidance

Monitor Checkmk audit logs for changes to active check and custom check configurations, particularly those made by administrative accounts. Inspect service discovery output pages and raw check configurations for HTML tags, JavaScript keywords (onclick, onload, etc.), or script payloads. Use browser developer tools to review the DOM of the service discovery page for unexpected inline scripts or event handlers. Log all administrative configuration changes and correlate with user sessions accessing the service discovery page during the same timeframe.

Why prioritize this

Although rated MEDIUM severity and not yet on the KEV list, this vulnerability merits prompt attention because it enables account compromise and lateral movement within a monitoring platform that administrators rely on for operational visibility. The persistent nature of stored XSS and the scope crossing (configuration context to rendering context) amplify risk. Prioritize patching environments with multiple administrators or shared check management responsibilities.

Risk score, explained

CVSS 3.1 score of 4.8 (MEDIUM) reflects the requirement for high privilege to inject the payload (PR:H) and user interaction (UI:R), combined with network accessibility (AV:N) and low complexity (AC:L). The impact is limited to confidentiality and integrity (C:L, I:L) with no availability impact (A:N), and the scope is changed (S:C), meaning the vulnerability affects resources beyond the vulnerable component (other users' browsers). The score appropriately penalizes the high privilege requirement while recognizing that stored XSS in a widely-used administrative interface can cascade to broader compromise.

Frequently asked questions