Potential livestatus injection in prediction graph page

Successful exploitation of CVE-2026-33457 allows an authenticated user to execute arbitrary Livestatus commands within the Checkmk environment. Livestatus is a protocol used for monitoring system resources, and injecting commands could allow an attacker to extract sensitive information, disrupt monitoring processes, or potentially gain further access to the underlying system. The impact is amplified if the Checkmk instance is used to monitor critical infrastructure, as compromised monitoring data could lead to incorrect operational decisions. This vulnerability is particularly concerning because it leverages an authenticated context, meaning an attacker needs valid credentials to exploit it, but once inside, the potential for damage is significant.

Organizations heavily reliant on Checkmk for monitoring critical infrastructure are particularly at risk. Environments with shared Checkmk instances or those with weak authentication practices are also more vulnerable. Specifically, those using legacy Checkmk configurations with less stringent input validation are at increased risk.

• linux / server:

journalctl -u checkmk -g "livestatus command injection"

• linux / server:

ps aux | grep livestatus | grep -i "crafted service name"

• generic web:

curl -I 'http://checkmk_server/prediction_graph?service_description=<crafted_service_name>' | grep 'Livestatus'

1. 2026-04-10Disclosure

   disclosure

1. 已保留2026-03-20
2. 发布日期2026-04-10
3. 修改日期2026-04-14
4. EPSS 更新日期2026-04-17

The primary mitigation for CVE-2026-33457 is to upgrade Checkmk to version 2.5.0b4 or later. If immediate upgrading is not feasible, consider restricting access to the prediction graph page to trusted users only. Implement strict input validation on the service description field to prevent malicious commands from being injected. While not a direct fix, configuring a Web Application Firewall (WAF) to filter out suspicious Livestatus commands can provide an additional layer of defense. Monitor Checkmk logs for unusual Livestatus command executions.