CVE-2026-77021

Improper handling of highly compressed data data amplification in Checkmk 2.5.0p14, 2.4.0p37, 2.3.0p51 and 2.2.0 EOL allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an...

CVE-2026-77021

Checkmk versions prior to 2.5.0p14 , 2.4.0p37 , and 2.3.0p51 , as well as the EOL 2.2.0 release, are affected by a data amplification vulnerability in the agent receiver. The root cause is a missing decompression size limit on zlib-compressed data sent by hosts registered in push mode. An attacke...

CVE-2026-77021 Missing decompression size limit in agent receiver allows memory exhaustion via push agent data

Improper handling of highly compressed data data amplification in Checkmk 2.5.0p14, 2.4.0p37, 2.3.0p51 and 2.2.0 EOL allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an...

EUVD-2026-83883

Improper handling of highly compressed data data amplification in Checkmk 2.5.0p14, 2.4.0p37, 2.3.0p51 and 2.2.0 EOL allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an...

EUVD-2026-70973

Improper certificate validation in Checkmk 2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their ow...

CVE-2026-15937

Checkmk versions prior to 2.5.0p10 contain an improper certificate validation flaw in agent receiver endpoints . The endpoints fail to verify that a presented mTLS certificate was issued by their own root certificate. As a result, a relay and a push agent that share the same UUID can reuse each o...

CVE-2026-15937 Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint

Improper certificate validation in Checkmk 2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their ow...

CVE-2026-15937 Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint

Improper certificate validation in Checkmk 2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their ow...

PT-2026-85434

Improper certificate validation in Checkmk 2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their ow...

CVE-2026-15937: Improper Certificate Validation

Improper certificate validation in Checkmk 2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their ow...

CVE-2026-15576

Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...

UBUNTU-CVE-2026-15576

Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...

CVE-2026-15576

CVE-2026-15576 is an improper authentication vulnerability in the agent receiver of Checkmk versions prior to 2.5.0p10 . An unauthenticated remote attacker can bypass mutual TLS (mTLS) client certificate verification on relay endpoints by supplying a fixed placeholder identity in the request URL....

CVE-2026-15576 Agent receiver accepts mTLS requests without a client certificate

Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...

CVE-2026-15576 Agent receiver accepts mTLS requests without a client certificate

Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...

EUVD-2026-63903

Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...

PT-2026-79357

Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...

CVE-2026-15576: Missing Authentication for Critical Function

Improper authentication in the agent receiver of Checkmk 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and...

CVE-2026-24097 Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 EOL allows authenticated users to enumerate existing hosts by observing different HTTP response codes in agent-receiver/registerexisting endpoint, which could lead to information disclosure...

PT-2026-25168

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 EOL allows authenticated users to enumerate existing hosts by observing different HTTP response codes in agent-receiver/register existing endpoint, which could lead to information disclosur...