CVE-2026-15937
Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.
| CWE | CWE-295 |
| Vendor | checkmk gmbh |
| Product | checkmk |
| Published | Sep 4, 2026 |
| Last Updated | Sep 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for checkmk gmbh checkmk
Be the first to know when new unknown vulnerabilities affecting checkmk gmbh checkmk are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Checkmk GmbH / Checkmk
2.5.0 < 2.5.0p10
Credits
🔍 PS Positive Security GmbH