CVE-2026-90990 in Checkmk
Summary
by MITRE • 09/22/2026
Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services outside their contact groups and occupying web server and Livestatus workers for an attacker-controlled duration.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified as Improper Neutralization of Newlines in Filter Values represents a significant security flaw within the Checkmk monitoring platform, specifically affecting versions prior to 2.5.0p14. This issue resides in the application logic governing the monitoring host and service list APIs, which serve as critical interfaces for retrieving system status data. The core technical deficiency lies in the insufficient sanitization of user-supplied input fields that are intended to hold filter values. Specifically, the application fails to properly neutralize newline characters embedded within these filter parameters before they are processed by the backend Livestatus query engine. This lack of proper input validation allows an authenticated attacker to manipulate the structure of the underlying database queries through a technique known as header injection or query manipulation via line breaks.
From a technical perspective, this flaw enables an authenticated user to inject additional Livestatus query headers into the request stream. In standard operation, these APIs are designed to return data based on predefined access controls and contact group memberships, ensuring that users only see information relevant to their assigned responsibilities. However, by injecting newline characters followed by specific command sequences, an attacker can effectively alter the scope of the query executed by the Livestatus server. This manipulation allows the injection of commands or parameters that bypass object visibility restrictions typically enforced during count queries and other data retrieval operations. Consequently, the application logic fails to isolate user sessions properly, leading to a breakdown in access control mechanisms that are fundamental to multi-tenant monitoring environments.
The operational impact of this vulnerability is twofold, encompassing both information disclosure and resource exhaustion. First, the ability to bypass object visibility restrictions allows an attacker to infer sensitive information about hosts and services that lie outside their authorized contact groups. This constitutes a violation of confidentiality principles, as it exposes the topology and status details of infrastructure components that should remain hidden from unauthorized personnel. Second, the vulnerability can be leveraged for denial-of-service attacks by occupying web server processes and Livestatus worker threads for an attacker-controlled duration. By crafting malicious queries that trigger complex or prolonged processing tasks, an attacker can exhaust available system resources, potentially degrading service availability for legitimate users and disrupting critical monitoring operations.
This incident aligns with several established industry standards regarding software security flaws. It is classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command, specifically adapted here for query header injection contexts, which shares characteristics with CWE-94 Improper Control of Generation of Code (Code Injection). Furthermore, the exploitation technique maps directly to MITRE ATT&CK techniques related to Discovery and Impact. The act of inferring information about unauthorized hosts corresponds to T1087 Account Discovery or general system enumeration tactics, while the resource exhaustion aspect relates to T1499 Endpoint Denial of Service or T1496 Resource Hijacking depending on the specific execution method used by the attacker.
To mitigate this vulnerability, organizations running Checkmk versions older than 2.5.0p14 must apply the latest security patches immediately. The vendor has addressed the improper neutralization issue in subsequent releases by implementing stricter input validation and output encoding mechanisms for all filter values passed to the Livestatus API endpoints. In addition to patching, administrators should enforce strict access controls on these APIs, ensuring that only necessary service accounts have elevated privileges. Network-level segmentation can also provide an additional layer of defense by restricting direct access to monitoring interfaces from untrusted networks. Regular security audits and penetration testing focused on input validation weaknesses are recommended to identify similar flaws in other API endpoints before they can be exploited.