CVE-2026-8078

MEDIUM CVSS 4.8 View on NVD ↗

Description

Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can change global settings to store malicious HTML or JavaScript in changelog messages that executes in other users' browsers when they view the Activate Changes page or Audit log.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected Products

checkmk/checkmk

References

https://checkmk.com/werk/17992

Published: Jun 08, 2026 13:16 UTC Modified: Jun 08, 2026 15:53 UTC