CVE-2026-8078

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0p5 Checkmk versions prior to 2.4.0p31 Checkmk versions prior to 2.3.0p48 Checkmk version 2.2.0

Description Stored cross-site scripting occurs in the global settings change log. An administrator with permissions to modify global settings can inject malicious HTML or JavaScript into changelog messages. This code executes in the browsers of other users when they access the Audit log or the Activate Changes page.

Recommendations Update to version 2.5.0p5 or newer. Update to version 2.4.0p31 or newer. Update to version 2.3.0p48 or newer. At the moment, there is no information about a newer version that contains a fix for this vulnerability.