CVE-2026-90990

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0p14

Description Improper neutralization of newlines in filter values within the monitoring host and service list APIs allows an authenticated user to inject additional Livestatus query headers. This can lead to the bypass of object visibility restrictions in count queries, enabling the attacker to infer information about hosts and services outside their assigned contact groups. Additionally, this issue can be used to occupy web server and Livestatus workers for a duration controlled by the attacker.

Recommendations Update to version 2.5.0p14 or later.