All vulnerabilities
CVE-2026-14452

Checkmk: Open redirect and XSS via reset_url parameter

Checkmk GmbH Checkmk
Open in ThreatlineRecord JSON
CVSS
8.6High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.5.0p15Also 2.4.0p38, 2.3.0p51CVE List
Published16 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.

Text from CVE List

Affected versions 4

  • Checkmkaffected: 2.5.0 before 2.5.0p15CVE List
  • Checkmkaffected: 2.4.0 before 2.4.0p38CVE List
  • Checkmkaffected: 2.3.0 before 2.3.0p51CVE List
  • Checkmkaffected: 2.2.0CVE List

References 1