CVE-2026-2859mediumCWE-204

Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.2%

probabilidade de exploração

0.2%top 91% das CVEs

exploração observada

nãonenhuma fonte reporta

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in deploy_agent endpoint, which could lead to information disclosure.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Checkmk GmbH · Checkmk

Referências

https://checkmk.com/werk/18994