Vulnerability details
CVE-2026-3466
Checkmk Checkmk
Cross-site scripting in dashlet title
CVSS 4.0
8.5High
Official description
Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.5High | 4.0 | CVEProject cvelistV5 (CNA) (Checkmk) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Checkmk GmbH | Checkmk | 2.2.0 | CVEProject cvelistV5 (CNA) |
| Checkmk GmbH | Checkmk | 2.3.0 ≤ v < 2.3.0p46 | CVEProject cvelistV5 (CNA) |
| Checkmk GmbH | Checkmk | 2.4.0 ≤ v < 2.4.0p25 | CVEProject cvelistV5 (CNA) |
| Checkmk GmbH | Checkmk | 2.5.0b1 ≤ v < 2.5.0 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://checkmk.com/werk/19033 vendor-advisory
- https://checkmk.com/werk/19583 vendor-advisory
- https://www.vulncheck.com/advisories/checkmk-stored-cross-site-scripting-in-dashlet-title third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-07
- Last updated
- 2026-04-22
- State
- Published
- Assigner (CNA)
- Checkmk
Exploit prediction (EPSS)
0.23%
Probability of exploitation in 30 days
14.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')