Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in deploy_agent endpoint, which could lead to information disclosure.
References
| Link | Resource |
|---|---|
| https://checkmk.com/werk/18994 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2026-03-13 19:54
Updated : 2026-03-18 13:23
NVD link : CVE-2026-2859
Mitre link : CVE-2026-2859
CVE.ORG link : CVE-2026-2859
JSON object : View
Products Affected
checkmk
- checkmk
CWE
CWE-204
Observable Response Discrepancy
