CVE-2026-15937
Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 4, 2026
- Updated
- Sep 4, 2026
- Reserved
- Jul 16, 2026
Description
Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | Checkmk |
Weaknesses
- CWE-295 Improper Certificate Validation
Affected Products
| Product | Versions |
|---|---|
CheckmkCheckmk GmbH |
|
References
- https://checkmk.com/werk/19735vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.