by Kastro
Paper/Archive/CVE-2026-121374

CVE-2026-121374

Checkmk GmbH Checkmk — Arbitrary file write and code execution via excluded node roles in Kubernetes special agent

CVSS 9.4
critical.is priorityof 100
28
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in the "Exclude nodes based on their role" rule option, leading to code execution as the site user.

Affected

ProductAffectedFixed inSource
Checkmk2.5.0 – < 2.5.0p192.5.0p19CNA
Checkmk2.4.0 – < 2.4.0p402.4.0p40CNA
Checkmk2.3.0–CNA

Scores by source

Checkmk (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

advisorycheckmk.com/werk/17994