Potential livestatus injection in notification test

Successful exploitation of CVE-2026-33456 could allow an attacker to execute arbitrary Livestatus commands on the Checkmk server. Livestatus is a protocol used for monitoring system resources, and injecting commands could enable an attacker to gather sensitive information, disrupt monitoring processes, or even gain further access to the underlying system. The impact is amplified if the Checkmk server has access to critical infrastructure or sensitive data. While authentication is required, a compromised user account could be leveraged to exploit this vulnerability, potentially leading to a significant security breach.

Organizations using Checkmk for system monitoring, particularly those with legacy configurations or shared hosting environments, are at risk. Environments where user accounts with access to the notification test page have elevated privileges are especially vulnerable.

• linux / server:

journalctl -u checkmk -g 'livestatus injection'

• linux / server:

ps aux | grep 'livestatus' | grep -v grep

• linux / server:

find /opt/check_mk/ -name '*service_description*' -print0 | xargs -0 grep -i 'malicious_command'

1. 2026-04-10Disclosure

   disclosure

1. 已保留2026-03-20
2. 发布日期2026-04-10
3. 修改日期2026-04-14
4. EPSS 更新日期2026-04-17

The primary mitigation for CVE-2026-33456 is to upgrade Checkmk to version 2.5.0b4 or later, which contains the fix. If immediate upgrade is not possible, restrict access to the notification test page to only authorized personnel. Review service descriptions for any unusual or suspicious content. Consider implementing a Web Application Firewall (WAF) with rules to detect and block malicious Livestatus commands. After upgrading, confirm the vulnerability is resolved by attempting to inject a benign Livestatus command via the notification test page and verifying that it is not executed.