CVE-2026-14452
8.6HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
- Impact
- Full C/I/A compromise
- Weakness
- CWE-601
Impact
Attackers can execute arbitrary script inside an authenticated admin's session or redirect them to an external site. To exploit this, an attacker needs a user with Setup access to open a crafted link and click 'Reset' or submit an empty search.
Root cause
The Setup in-page search feature fails to validate the 'reset_url' parameter.
Affected systems
Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51, and all 2.2.0 (EOL) releases
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade to Checkmk 2.5.0p15, 2.4.0p38, or 2.3.0p51 (or migrate off 2.2.0); no interim configuration mitigation is provided.
$ omd versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.