CVE-2025-39663

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services outside their contact groups and occupying web server and Livestatus workers for an attacker-controlled duration.

In Checkmk versions <2.4.0p23, <2.3.0p45, and 2.2.0, there is a vulnerability related to the exposure of the session signing secret. An administrator of a remote site with config sync enabled can hijack sessions on the central site by forging session cookies.

Checkmk versions <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL) contain improper certificate validation. The bundled trust stores from "certifi" and "webpki-roots" include a root CA that trusts eMudhra (emSign) intermediate certificates whose private keys are public.

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file, or to the 'oratab' file itself, to execute code as root if an agent has the 'mk-oracle' plugin enabled.

Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.

Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.

In Checkmk versions <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL), insufficiently protected credentials in host and folder configuration endpoints of the REST API allow an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases and IPMI passwords in clear text from GET responses, although the setup GUI never displays these values.

Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an arbitrary size.

In Checkmk versions before 2.5.0p10, improper certificate validation allows a relay and a push agent sharing the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.

Missing authorization in Checkmk versions <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results.