Checkmk fixes three critical code-execution flaws; 2.3 gets none

Checkmk fixes three critical code-execution flaws; 2.3 gets none

3 November 2026: Checkmk has fixed three flaws scored 9.4 (Critical) under CVSS 4.0 that each end in code execution on the monitoring server, in versions 2.5.0p19 and 2.4.0p40. The most easily reached, CVE-2026-121374, needs nothing more than the right to edit rules in one folder. Version 2.3.0 is affected by all three and gets no fix, because it has reached end of life.

Not yet independently verified. Checkmk's werk pages date the fixes from 29 October to 3 November but do not give the release date of 2.5.0p19 and 2.4.0p40, and no exploitation has been reported. We will update this when it can be confirmed, and remove this note.

A rule editor can run code

CVE-2026-121374 (werk 17994) sits in the Kubernetes special agent, which passed node roles from a rule option to its command line without separating them from other options. A role could therefore be read as an option, among them --profile, which writes profiling data to a file. That let a user write an executable Python script anywhere the site user can write, and run code as the site user.

Two things widen the exposure. By default "Normal monitoring user" accounts with folder permissions can edit rules, and every site is affected, including those that monitor no Kubernetes at all, because the attacker can create the rule. Checkmk found the flaw in an internal review. The fix passes each role as a single value and confines profiling output to the site's debug directory.

Remote sites and Robotmk

CVE-2026-118965 (werk 22120) concerns distributed monitoring. When the central site updates host labels it asks the remote sites and writes their answers to disk, and the target filename was not checked, so a malicious remote site could write arbitrary files on the central site. In Checkmk's words, "every setup with potentially untrusted remote sites is affected". A single-site installation is not.

CVE-2026-120495 (werk 22624) needs more: an attacker who already controls a monitored host, usually with root, adds crafted agent output such as a malicious plug-in or spool file, and the Robotmk HTML log service then writes an HTML file through path traversal. It also needs automatic service discovery on that host, or an administrator who accepts the new Robotmk services. This one affects the Pro, Ultimate, Cloud and Ultimate MT editions only; the other two affect every edition, Community included.

Versions to install

• 2.5.0: fixed in 2.5.0p19
• 2.4.0: fixed in 2.4.0p40
• 2.3.0: affected, end of life, no fix; upgrade to a supported line
• 3.0.0: fixed from 3.0.0b1, not yet released

None of the three needs configuration changes after the update. Sites still on 2.3 have the clearest reason to move, since a rule editor there can still reach code execution.

Our catalogue lists nine network monitoring products.

Sources

• Checkmk: Werk #17994, Kubernetes arbitrary file write and code execution via excluded node roles, 3 November 2026
• Checkmk: Werk #22120, code execution through compromised remote site, 29 October 2026
• Checkmk: Werk #22624, code execution through Robotmk HTML log test service, 2 November 2026