Description
Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.
Published: 2026-09-04
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://checkmk.com/werk/19735 cve-icon cve-icon
History

Fri, 04 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Description Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.
Title Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint
First Time appeared Checkmk
Checkmk checkmk
Weaknesses CWE-295
CPEs cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*
Vendors & Products Checkmk
Checkmk checkmk
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Checkmk Checkmk
cve-icon MITRE

Status: PUBLISHED

Assigner: Checkmk

Published:

Updated: 2026-09-04T08:24:49.802Z

Reserved: 2026-07-16T08:40:57.255Z

Link: CVE-2026-15937

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T09:17:10.410

Modified: 2026-09-04T09:17:10.410

Link: CVE-2026-15937

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T09:30:04Z

Weaknesses