CVE-2026-33456
Checkmk 2.4.0 … 2.5.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-33456 is a medium-severity Improper Neutralization of Delimiters (CWE-140) vulnerability in Checkmk Checkmk. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33456, published on 2026-04-10, is a Livestatus injection vulnerability in the notification test mode of Checkmk versions prior to 2.5.0b4 and 2.4.0p26. It enables an authenticated user with access to the notification test page to inject arbitrary Livestatus commands by supplying a crafted service description. The issue carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) and maps to CWE-140.
An attacker requires low privileges as an authenticated user with access to the notification test page. Exploitation is possible remotely over the network with low complexity and without user interaction. By injecting arbitrary Livestatus commands, the attacker can achieve low-level impacts on confidentiality and integrity, as well as high impact on availability.
The Checkmk advisory at https://checkmk.com/werk/17989 provides details on mitigation and patches for affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21344
Vulnerability Data
Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via a crafted service description.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect delimiter neutralization through targeted test cases.
Input validation directly enforces neutralization of delimiters before they reach parsers or interpreters.
Secure engineering principles include explicit requirements for proper delimiter handling and sanitization.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper delimiter neutralization during input handling and output encoding.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect delimiter-related weaknesses before deployment.
Secure development life cycle incorporates practices that reduce the likelihood of delimiter-neutralization defects.
Application security requirements include input validation and output encoding that mitigate delimiter mishandling.
Secure coding explicitly requires proper neutralization of delimiters to prevent injection and parsing flaws.