CVE-2026-24097

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows authenticated users to enumerate existing hosts by observing different HTTP response codes in agent-receiver/register_existing endpoint, which could lead to information disclosure.

Score

CVSS 4.0 5.3 Medium

Status

Analyzed - security@checkmk.com

Published

2026-03-13

Last modified

2026-03-13

Weaknesses

CWE-204

Affected products

• Checkmk (Checkmk)

References

• https://checkmk.com/werk/18993