CVE-2026-121374

EUVD-2026-123350
Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in the "Exclude nodes based on their role" rule option, leading to code execution as the site user.
Argument Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
CheckmkCNA
9.4 CRITICAL
NETWORK
LOW
LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
checkmkcheckmk
2.5.0 ≤
𝑥
≤ 2.5.0p18
CNA
checkmkcheckmk
2.4.0 ≤
𝑥
≤ 2.4.0p39
CNA
checkmkcheckmk
2.3.0
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://checkmk.com/werk/17994