CVE-2026-15937
Last modified
CVE-2026-15937 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Checkmk GmbH | Checkmk | >= 2.5.0, < 2.5.0p10 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-15937?
How severe is CVE-2026-15937?
How do I fix CVE-2026-15937?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-15929Improper neutralization of special elements used in an SQL c…7.1
- CVE-2026-1593A weakness has been identified in itsourcecode Society Manag…9.8
- CVE-2026-15930The Simple Membership WordPress plugin before 4.7.8 does not…9.4
- CVE-2026-15931The Simple Membership WordPress plugin before 4.7.8 does not…6.1
- CVE-2026-15932The Support Genix WordPress plugin before 1.4.48 does not p…5.3
- CVE-2026-15933OptimiDoc Server (On-Premise) stores credentials for externa…6.9
- CVE-2026-15939The Simple Restrict WordPress plugin before 1.2.9 does not e…2.7
- CVE-2026-1594A security vulnerability has been detected in itsourcecode S…9.8
- CVE-2026-15941The plugin provides an Admin Search page that allows users w…6.5
- CVE-2026-15943A flaw was found in the Keycloak keycloak-services component…5.5
- CVE-2026-15945A flaw was found in the group search functionality of the Ke…2.7
- CVE-2026-15946The Search Atlas SEO – Premier SEO Plugin for One-Click WP P…4.3
Are you affected by CVE-2026-15937?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST