CVE-2026-33456
Published: 10 April 2026
Summary
CVE-2026-33456 is a high-severity Improper Neutralization of Delimiters (CWE-140) vulnerability in Checkmk Checkmk. Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates and sanitizes user inputs like crafted service descriptions to prevent Livestatus command injection in the notification test mode.
Enforces least privilege to restrict access to the notification test page, preventing low-privileged authenticated users from exploiting the injection vulnerability.
Mandates timely flaw remediation through patching to Checkmk versions 2.5.0b4 or 2.4.0p26, eliminating the Livestatus injection vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Livestatus command injection in Checkmk web UI (notification test page) directly enables remote exploitation of a public-facing application over the network by an authenticated user.
NVD Description
Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via a crafted service description.
Deeper analysisAI
CVE-2026-33456, published on 2026-04-10, is a Livestatus injection vulnerability in the notification test mode of Checkmk versions prior to 2.5.0b4 and 2.4.0p26. It enables an authenticated user with access to the notification test page to inject arbitrary Livestatus commands by supplying a crafted service description. The issue carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) and maps to CWE-140.
An attacker requires low privileges as an authenticated user with access to the notification test page. Exploitation is possible remotely over the network with low complexity and without user interaction. By injecting arbitrary Livestatus commands, the attacker can achieve low-level impacts on confidentiality and integrity, as well as high impact on availability.
The Checkmk advisory at https://checkmk.com/werk/17989 provides details on mitigation and patches for affected versions.
Details
- CWE(s)