Vulnerability · Published Aug 21, 2026 · Assigned by Checkmk

CVE-2026-15576Agent receiver accepts mTLS requests without a client certificate

Medium 6.9

In plain English

A medium-severity missing authentication in Checkmk from Checkmk GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 60.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only the Cloud, Ultimate and Ultimate MT editions are affected, as other editions do not expose relay endpoints.

Affected products (as reported)

Vendor	Product	Versions
Checkmk GmbH	Checkmk	2.5.0 – before 2.5.0p10

Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://checkmk.com/werk/20174 vendor-advisory