Home

Description

Stored cross-site scripting in the URL dashboard widget in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions to store a URL with a dangerous URI scheme such as javascript: that executes scripts in other users' browsers when they view the dashboard.

PUBLISHED Reserved 2026-04-27 | Published 2026-06-08 | Updated 2026-06-08 | Assigner Checkmk




HIGH: 8.5CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status
unaffected

2.5.0 (semver) before 2.5.0p5
affected

2.4.0 (semver) before 2.4.0p31
affected

2.3.0 (semver) before 2.3.0p48
affected

2.2.0 (semver)
affected

References

checkmk.com/werk/17991 vendor-advisory

cve.org (CVE-2026-7186)

nvd.nist.gov (CVE-2026-7186)

Download JSON