Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90990

Livestatus injection via monitoring filter values

CVSS 4.0 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-90990

Published

Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to infer information about hosts and services outside their contact groups and occupying web server and Livestatus workers for an attacker-controlled duration.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90990

Published

Checkmk

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "product": "Checkmk",
                    "vendor": "Checkmk GmbH",
                    "versions": [
                        {
                            "lessThan": "2.5.0p14",
                            "status": "affected",
                            "version": "2.5.0",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON