CVE-2026-15576
Agent receiver accepts mTLS requests without a client certificate
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only the Cloud, Ultimate and Ultimate MT editions are affected, as other editions do not expose relay endpoints.
| CWE | CWE-306 |
| Vendor | checkmk gmbh |
| Product | checkmk |
| Published | Aug 21, 2026 |
| Last Updated | Aug 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for checkmk gmbh checkmk
Be the first to know when new unknown vulnerabilities affecting checkmk gmbh checkmk are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Checkmk GmbH / Checkmk
2.5.0 < 2.5.0p10
Credits
🔍 PS Positive Security GmbH