CVE-2026-33457

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33457", "assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "state": "PUBLISHED", "assignerShortName": "Checkmk", "dateReserved": "2026-03-20T10:30:13.353Z", "datePublished": "2026-04-10T08:31:35.768Z", "dateUpdated": "2026-04-14T13:29:41.112Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Checkmk", "vendor": "Checkmk GmbH", "versions": [{"lessThan": "2.5.0b4", "status": "affected", "version": "2.5.0", "versionType": "semver"}, {"lessThan": "2.4.0p26", "status": "affected", "version": "2.4.0", "versionType": "semver"}, {"lessThan": "2.3.0p47", "status": "affected", "version": "2.3.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value."}], "impacts": [{"capecId": "CAPEC-15", "descriptions": [{"lang": "en", "value": "CAPEC-15: Command Delimiters"}]}], "metrics": [{"cvssV4_0": {"baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-140", "description": "CWE-140: Improper Neutralization of Delimiters", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "shortName": "Checkmk", "dateUpdated": "2026-04-10T08:31:35.768Z"}, "references": [{"url": "https://checkmk.com/werk/17990", "tags": ["vendor-advisory"]}], "title": "Potential livestatus injection in prediction graph page", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.5.0", "versionEndExcluding": "2.5.0b4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.4.0", "versionEndExcluding": "2.4.0p26"}, {"vulnerable": true, "criteria": "cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.3.0", "versionEndExcluding": "2.3.0p47"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T03:55:38.235031Z", "id": "CVE-2026-33457", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T13:29:41.112Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33457", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-14T03:55:38.235031Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T12:47:20.307Z"}}], "cna": {"title": "Potential livestatus injection in prediction graph page", "impacts": [{"capecId": "CAPEC-15", "descriptions": [{"lang": "en", "value": "CAPEC-15: Command Delimiters"}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}}], "affected": [{"vendor": "Checkmk GmbH", "product": "Checkmk", "versions": [{"status": "affected", "version": "2.5.0", "lessThan": "2.5.0b4", "versionType": "semver"}, {"status": "affected", "version": "2.4.0", "lessThan": "2.4.0p26", "versionType": "semver"}, {"status": "affected", "version": "2.3.0", "lessThan": "2.3.0p47", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://checkmk.com/werk/17990", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-140", "description": "CWE-140: Improper Neutralization of Delimiters"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.5.0b4", "versionStartIncluding": "2.5.0"}, {"criteria": "cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.4.0p26", "versionStartIncluding": "2.4.0"}, {"criteria": "cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.3.0p47", "versionStartIncluding": "2.3.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "shortName": "Checkmk", "dateUpdated": "2026-04-10T08:31:35.768Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33457", "state": "PUBLISHED", "dateUpdated": "2026-04-14T13:29:41.112Z", "dateReserved": "2026-03-20T10:30:13.353Z", "assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f", "datePublished": "2026-04-10T08:31:35.768Z", "assignerShortName": "Checkmk"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Checkmk", "vendor": "Checkmk GmbH", "versions": [{"lessThan": "2.5.0b4", "status": "affected", "version": "2.5.0", "versionType": "semver"}, {"lessThan": "2.4.0p26", "status": "affected", "version": "2.4.0", "versionType": "semver"}, {"lessThan": "2.3.0p47", "status": "affected", "version": "2.3.0", "versionType": "semver"}]}], "source": "security@checkmk.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:-:*:*:*:*:*:*", "matchCriteriaId": "83202950-840A-4CB7-AD96-CE62E84FABD8", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:b1:*:*:*:*:*:*", "matchCriteriaId": "1A020A77-7D84-4557-9B0B-D74A89BC1538", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:b2:*:*:*:*:*:*", "matchCriteriaId": "D9770554-978B-4552-9E0E-CD6B6675243C", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:b3:*:*:*:*:*:*", "matchCriteriaId": "1883D2F4-CB96-4DDE-87E8-D1990A3FA092", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:b4:*:*:*:*:*:*", "matchCriteriaId": "99AD6F39-AF67-4CB9-BED2-00CA75B9F5DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:b5:*:*:*:*:*:*", "matchCriteriaId": "F08FE580-67D4-419C-AE4A-3B9EBC6A2838", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:b6:*:*:*:*:*:*", "matchCriteriaId": "9DD5C67F-CD3E-400E-802D-8B52408A259F", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p1:*:*:*:*:*:*", "matchCriteriaId": "310A2FA2-633A-48FB-A5C2-9A9A922E72E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p10:*:*:*:*:*:*", "matchCriteriaId": "3C0F1DC8-D9DF-4A7A-80DC-618FAB091375", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p11:*:*:*:*:*:*", "matchCriteriaId": "9B0A1E3E-1B5A-4346-95BC-DE6FF6EE14CA", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p12:*:*:*:*:*:*", "matchCriteriaId": "EB52B2A7-BDC1-4A4F-ABAF-69C1BA8E83C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p13:*:*:*:*:*:*", "matchCriteriaId": "9F89225F-6969-4D89-B889-9CB09972825B", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p14:*:*:*:*:*:*", "matchCriteriaId": "2A1B23EA-4571-4E4E-80BC-FD76FFD83FFB", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p15:*:*:*:*:*:*", "matchCriteriaId": "625A6998-5DAE-4538-9760-20523CCE501F", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p16:*:*:*:*:*:*", "matchCriteriaId": "6EFD4461-2C37-418F-90AD-3A956B2D91C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p17:*:*:*:*:*:*", "matchCriteriaId": "88523633-844C-41FE-ADF1-74D6AA2BCE6C", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p18:*:*:*:*:*:*", "matchCriteriaId": "5DA03E01-06D1-4E18-9C7B-CB6E49E5954B", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p19:*:*:*:*:*:*", "matchCriteriaId": "91F171B6-7F9A-4B9B-B53D-277FE74124F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p2:*:*:*:*:*:*", "matchCriteriaId": "7D1993E3-C4F9-4D78-BD02-A0B22D93BF1F", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p20:*:*:*:*:*:*", "matchCriteriaId": "34FF7D09-2129-4266-BF71-5424DC9E18B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p21:*:*:*:*:*:*", "matchCriteriaId": "246F0BA5-F927-4204-97F3-51870072599F", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p22:*:*:*:*:*:*", "matchCriteriaId": "86ED47B6-58FB-4BAC-9C87-F7BC08AB3870", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p23:*:*:*:*:*:*", "matchCriteriaId": "2CFF173A-373B-4948-BD22-86C031B58E6B", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p24:*:*:*:*:*:*", "matchCriteriaId": "90648825-55F7-472A-944E-7E5C787FAFB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p25:*:*:*:*:*:*", "matchCriteriaId": "6EE2BA6D-737A-4EEB-B8A2-91E9C61B70C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p26:*:*:*:*:*:*", "matchCriteriaId": "94FA8F05-267D-4B24-9AA3-A77FAD259310", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p27:*:*:*:*:*:*", "matchCriteriaId": "085B463B-633A-447A-B61C-99DD78B49A00", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p28:*:*:*:*:*:*", "matchCriteriaId": "F5DB112B-EE65-4BAB-AED8-716E618FD89C", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p29:*:*:*:*:*:*", "matchCriteriaId": "CD9EDBC8-A6A7-4348-8446-1D1DDDACDC51", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p3:*:*:*:*:*:*", "matchCriteriaId": "B28A0C9D-072A-413C-8587-CD57CB918190", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p30:*:*:*:*:*:*", "matchCriteriaId": "CB0E10D1-2497-4CAE-ABA5-9F861C6A65DF", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p31:*:*:*:*:*:*", "matchCriteriaId": "9E64A46A-A1E2-4272-A7B8-36140AF2B889", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p32:*:*:*:*:*:*", "matchCriteriaId": "28568D2A-CA5B-42C2-8A32-FF783CB7A06F", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p33:*:*:*:*:*:*", "matchCriteriaId": "F82F8827-B7B2-4C10-A42A-77781BC7B24B", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p34:*:*:*:*:*:*", "matchCriteriaId": "F641BB83-8A0D-42D0-AB3E-7314918FDC9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p35:*:*:*:*:*:*", "matchCriteriaId": "FCCE61D4-00B1-4D83-8FAE-8F2FA8F48E2F", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p36:*:*:*:*:*:*", "matchCriteriaId": "FDB9628A-5A72-4DD5-9D4A-CBE13B0CFDF4", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p37:*:*:*:*:*:*", "matchCriteriaId": "E34FEBB1-0935-4363-B4FE-45901BFC9A5D", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p38:*:*:*:*:*:*", "matchCriteriaId": "5C43DE3C-0098-4613-B2A4-39607A63CE42", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p39:*:*:*:*:*:*", "matchCriteriaId": "7F5F5665-C2A9-4877-B3F6-59059A1EEFF6", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p4:*:*:*:*:*:*", "matchCriteriaId": "DF22D0A7-82B1-4598-B8C5-BDFE523D07F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p40:*:*:*:*:*:*", "matchCriteriaId": "7352D105-D045-427C-BA79-0B16D41139D9", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p41:*:*:*:*:*:*", "matchCriteriaId": "589909F7-D6E5-4B33-9735-2B97E0B37B87", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p42:*:*:*:*:*:*", "matchCriteriaId": "1BB8717F-F458-4E4C-8D8D-C4F68D4D4B05", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p43:*:*:*:*:*:*", "matchCriteriaId": "1F621FFA-A2C8-46AD-8690-A16CF8B3A048", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p44:*:*:*:*:*:*", "matchCriteriaId": "70807D99-2DAC-4363-BAB3-D047C79DBFBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p45:*:*:*:*:*:*", "matchCriteriaId": "AD50FAD8-9878-4E77-B50D-5359ABFB94DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p46:*:*:*:*:*:*", "matchCriteriaId": "0B7FE8F8-E746-45E4-9A20-1873FDF231E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p5:*:*:*:*:*:*", "matchCriteriaId": "20035AFB-75B4-4164-9833-A2FCAE24B577", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p6:*:*:*:*:*:*", "matchCriteriaId": "8BCBACEB-7130-455D-B4BE-243053C116DC", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p7:*:*:*:*:*:*", "matchCriteriaId": "156384E2-E04B-4153-A91F-3F307C9FEAE8", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p8:*:*:*:*:*:*", "matchCriteriaId": "EEC0ED95-F43B-46D7-9AA0-A0FB1C32EF1D", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.3.0:p9:*:*:*:*:*:*", "matchCriteriaId": "91C194C1-5292-4E2A-BB71-9C5CD3CE6194", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:-:*:*:*:*:*:*", "matchCriteriaId": "022C075A-4B04-4141-A7D7-F93C9A7CE0FD", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:b1:*:*:*:*:*:*", "matchCriteriaId": "60C00469-0CD1-4E9C-8370-CE113842056C", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:b2:*:*:*:*:*:*", "matchCriteriaId": "179905FC-821F-4214-A872-E4E3702419D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:b3:*:*:*:*:*:*", "matchCriteriaId": "04956994-D5A8-45EE-9DC2-8A1D3058CE8E", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:b4:*:*:*:*:*:*", "matchCriteriaId": "8868449B-7259-4C3B-8344-0EFE0BA3A97E", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:b5:*:*:*:*:*:*", "matchCriteriaId": "BBDF3A13-582F-43D2-B42F-0DC42D4FBFBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:b6:*:*:*:*:*:*", "matchCriteriaId": "DAF500B3-AA6A-4618-BC7E-0F214B795E0F", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p1:*:*:*:*:*:*", "matchCriteriaId": "1CFE68AB-1F57-497C-9229-29ED3A73D87F", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p10:*:*:*:*:*:*", "matchCriteriaId": "577F9F72-2FDA-4F87-A840-05158F2368B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p11:*:*:*:*:*:*", "matchCriteriaId": "6F3AD894-660B-41FC-B910-899A764A00B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p12:*:*:*:*:*:*", "matchCriteriaId": "21853BB4-1BB5-40E3-82E2-253899D898ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p13:*:*:*:*:*:*", "matchCriteriaId": "E7963D66-A89A-4167-A2BA-DFF89B439EAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p14:*:*:*:*:*:*", "matchCriteriaId": "42099281-2026-4507-A20B-C669C206ADB6", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p15:*:*:*:*:*:*", "matchCriteriaId": "29A44B1E-83CD-4A3D-AFFD-82AAC7760293", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p16:*:*:*:*:*:*", "matchCriteriaId": "B4B87192-D81E-4269-ABF3-8D700BB531B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p17:*:*:*:*:*:*", "matchCriteriaId": "3D35CD46-F8CF-49C3-8CD9-53E1ED038023", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p18:*:*:*:*:*:*", "matchCriteriaId": "D5B5649C-C0BA-4905-98DD-CA606DD2B886", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p19:*:*:*:*:*:*", "matchCriteriaId": "29148EA6-675F-4B35-81BF-B8254C1EB675", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p2:*:*:*:*:*:*", "matchCriteriaId": "B11306B4-1092-470C-BA87-DBD02A18A74B", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p20:*:*:*:*:*:*", "matchCriteriaId": "9E85F65E-A103-425E-8AD5-7EE9F093B463", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p21:*:*:*:*:*:*", "matchCriteriaId": "65DF329A-4E2D-4138-99C5-6765789051CB", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p22:*:*:*:*:*:*", "matchCriteriaId": "1B9B340D-84F6-4CE9-A627-E26F340B3705", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p23:*:*:*:*:*:*", "matchCriteriaId": "CCAD0F84-7273-4FDF-B238-177E1C4D5F5B", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p24:*:*:*:*:*:*", "matchCriteriaId": "860D2E5C-6277-44F5-A3FE-C085F76B8514", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p25:*:*:*:*:*:*", "matchCriteriaId": "FAEB7D48-C80F-4804-8E76-C950B9714533", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p3:*:*:*:*:*:*", "matchCriteriaId": "74F78C48-030A-48A1-B69E-04C4EA5CCC12", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p4:*:*:*:*:*:*", "matchCriteriaId": "8701A914-774B-4E3B-A651-4A9FD19A187A", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p5:*:*:*:*:*:*", "matchCriteriaId": "19E40054-C44D-4C4C-B077-0333D8201E5B", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p6:*:*:*:*:*:*", "matchCriteriaId": "0E2D2F49-32B2-42AA-B99E-7C39403CF104", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p7:*:*:*:*:*:*", "matchCriteriaId": "ACE440F8-EBF5-4DBB-A215-57D770C66219", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p8:*:*:*:*:*:*", "matchCriteriaId": "1A94395D-DDCE-4977-89CA-46F71C3CA2B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.4.0:p9:*:*:*:*:*:*", "matchCriteriaId": "9513876C-8DF0-4A59-864F-8401BAA43376", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.5.0:b1:*:*:*:*:*:*", "matchCriteriaId": "F8943BB3-1487-494C-B4EB-89EB0B18B6A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.5.0:b2:*:*:*:*:*:*", "matchCriteriaId": "5342045D-CB9F-4663-9538-8B657C9AC833", "vulnerable": true}, {"criteria": "cpe:2.3:a:checkmk:checkmk:2.5.0:b3:*:*:*:*:*:*", "matchCriteriaId": "E9566834-D4EE-4104-AD60-7988FCF17224", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value."}, {"lang": "es", "value": "Inyecci\u00f3n de Livestatus en la p\u00e1gina del gr\u00e1fico de predicci\u00f3n en Checkmk anterior a 2.5.0b4, anterior a 2.4.0p26 y anterior a 2.3.0p47 permite a un usuario autenticado inyectar comandos Livestatus arbitrarios a trav\u00e9s de un par\u00e1metro de nombre de servicio manipulado debido a una sanitizaci\u00f3n insuficiente del valor de la descripci\u00f3n del servicio."}], "id": "CVE-2026-33457", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@checkmk.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33457", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T03:55:38.235031Z", "version": "2.0.3"}}]}, "published": "2026-04-10T09:16:24.630", "references": [{"source": "security@checkmk.com", "tags": ["Vendor Advisory"], "url": "https://checkmk.com/werk/17990"}], "sourceIdentifier": "security@checkmk.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-140"}], "source": "security@checkmk.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.5.0,2.5.0b4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.4.0,2.4.0p26)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.3.0,2.3.0p47)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Checkmk", "source": "cna", "vendor": "Checkmk GmbH"}, "product": "checkmk", "vendor": "checkmk"}], "analysis": {"en": {"generated_at": "2026-04-10T09:20:37.425513+00:00", "value": {"mitigation_remediation": ["Upgrade Checkmk to version 2.5.0b4 or newer", "Confirm that the prediction graph page is no longer vulnerable after the update", "If an immediate upgrade is not possible, restrict authenticated user access and monitor for unusual Livestatus activity"], "summary": {"action": "Patch Now", "impact": "Command Injection"}, "threat_synthesis": {"affected_systems": "The affected product is Checkmk by Checkmk GmbH. Versions before 2.5.0b4, before 2.4.0p26, and before 2.3.0p47 are vulnerable. It specifically affects the prediction graph interface where service names are processed.", "description_and_impact": "The vulnerability arises from inadequate sanitization of the service description field on the prediction graph page, allowing an authenticated user to inject arbitrary Livestatus commands. This could let the attacker execute unintended commands within the Checkmk environment, potentially exposing sensitive monitoring data or manipulating the system\u2019s state, thereby compromising data integrity and confidentiality. The weakness aligns with a command injection attack.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA\u2019s KEV catalog. The attack requires an authenticated Checkmk session and manipulation of the service name parameter; once achieved, arbitrary Livestatus commands can be executed. The risk of exploitation is moderate and depends on attacker access to a valid user account."}}}}, "created": "2026-04-10T09:26:21.555204+00:00", "updated": "2026-04-10T14:40:52.168378+00:00", "vendors": ["checkmk", "checkmk$PRODUCT$checkmk"]}