CVE-2026-20915 Checkmk GmbH CVE debrief

Who should care

Users of Checkmk version 2.5.0 (beta) before 2.5.0b2, particularly those with permission to create pending changes, should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 2.5.0b2 or later and restricting permissions to create pending changes to only trusted users. Security teams and platform operators should review their deployments and verify their configurations to ensure they are not exposed to this vulnerability.

Technical summary

The vulnerability is a stored cross-site scripting (XSS) issue in the Pending Changes sidebar of Checkmk. An authenticated user with permission to create pending changes can inject malicious JavaScript, which will be executed in the browsers of other users viewing the sidebar. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. This issue has a CVSS score of 8.5 and a severity of HIGH.

Defensive priority

High priority should be given to mitigating this vulnerability, as it allows for the injection of malicious JavaScript and has a high CVSS score.

Recommended defensive actions

• Update Checkmk to version 2.5.0b2 or later
• Restrict permissions to create pending changes to only trusted users
• Monitor for suspicious activity in the Pending Changes sidebar
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-03-31T15:16:11.527Z and was last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Checkmk version 2.5.0 (beta) before 2.5.0b2. Users should verify their deployments and review the official advisory for mitigation steps.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.