CVE-2026-14452 in Checkmk
Summary
by MITRE • 10/16/2026
Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified as CVE-2024-1358 represents a critical security flaw within the in-page search functionality of Checkmk versions prior to 2.5.0p15, 2.4.0p38, 2.3.0p51, and the end-of-life version 2.2.0. This issue stems from an improper validation mechanism applied to the reset_url parameter during the setup process of the search interface. The core technical flaw lies in the application's failure to strictly validate or sanitize the URL provided for resetting the search state. Instead of restricting this parameter to a predefined list of safe internal paths or enforcing strict origin checks, the software accepts arbitrary values passed by the client side without sufficient verification against cross-site scripting (XSS) vectors or open redirect patterns. This lack of rigorous input validation allows an attacker who can influence the URL structure to inject malicious payloads directly into the context of the authenticated user's session.
From a technical perspective, this vulnerability enables two distinct attack vectors depending on how the crafted payload is constructed and delivered. In its most severe form, if the reset_url parameter is reflected in the HTML output without proper encoding or escaping, an attacker can execute arbitrary JavaScript code within the victim's browser context. This constitutes a stored or reflected cross-site scripting (XSS) vulnerability, categorized under CWE-79: Improper Neutralization of Input During Web Page Generation. By injecting malicious scripts, an adversary gains the ability to perform actions on behalf of the authenticated user with Setup access. These actions can include stealing session cookies, capturing sensitive configuration data, modifying system settings, or performing administrative tasks that should be restricted to authorized personnel only. The impact is particularly severe because it targets users who already possess elevated privileges within the Checkmk environment.
Alternatively, if the application logic prioritizes redirection over script execution, the flaw facilitates an open redirect vulnerability, classified under CWE-601: URL Redirection to Untrusted Site. In this scenario, the attacker tricks a user into clicking a crafted link that points to a malicious domain via the reset_url parameter. When the victim interacts with the search interface by submitting an empty query or clicking the Reset button, the application redirects them to the external site controlled by the attacker. This vector is commonly exploited in phishing campaigns where the redirect serves as a mechanism to bypass security warnings or to direct users to credential harvesting pages that mimic legitimate Checkmk login portals. The ATT&CK framework maps this behavior to techniques such as T1078: Valid Accounts, specifically when used for initial access through social engineering, and potentially T1566.002: Spearphishing Link if the redirect is part of a targeted campaign.
The operational impact of this vulnerability extends beyond immediate data theft or session hijacking. For organizations relying on Checkmk for infrastructure monitoring, compromising an account with Setup access can lead to significant disruption of monitoring capabilities. An attacker could alter alert thresholds, disable critical notifications, or tamper with host and service configurations, thereby masking malicious activities within the network or causing denial of service conditions through misconfiguration. Furthermore, because the vulnerability requires user interaction such as clicking a link or submitting a search query, it relies heavily on social engineering tactics to achieve exploitation. This makes detection difficult for automated security tools that do not monitor behavioral anomalies in web application interactions closely enough to identify malicious URL parameters being processed by the backend logic.
Mitigation strategies must focus primarily on upgrading the Checkmk installation to patched versions where this validation issue has been resolved. For environments where immediate patching is not feasible, administrators should implement strict access controls to limit who can interact with the Setup interface and monitor logs for unusual patterns in search queries or reset actions that might indicate exploitation attempts. Additionally, deploying a Web Application Firewall (WAF) with rules designed to detect common XSS payloads and open redirect patterns in URL parameters can provide an additional layer of defense. It is also advisable to enforce Content Security Policy headers where applicable to mitigate the impact of any successful script injection by restricting the sources from which scripts can be executed. Regular security audits and penetration testing should include specific checks for input validation flaws in search and navigation functionalities to ensure that similar vulnerabilities are identified and remediated before they can be exploited in production environments.