Vulnerability · Published Mar 31, 2026 · Assigned by Checkmk
CVE-2026-20915Stored cross-site scripting in Pending Changes sidebar
High 8.5
In plain English
A high-severity cross-site scripting in Checkmk from Checkmk GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).
Severity (CVSS 4.0)8.5High
Exploit odds (30 days)0.2%top 95.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Checkmk GmbH | Checkmk | 2.5.0b1 – before 2.5.0b2 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N
References
- https://checkmk.com/werk/19526 vendor-advisory