CVE-2026-15576— Agent receiver accepts mTLS requests without a client certificate
Quick assessment
Affected
Checkmk GmbH Checkmk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Checkmk 版本低于 2.5.0p10 的代理接收模块中存在身份验证缺陷。未经认证的远程攻击者通过在请求 URL 中提供固定的占位符身份标识，可以绕过中继端点的双向 TLS（mTLS）客户端证书验证，从而导致对数据完整性和系统可用性造成有限影响。该漏洞仅影响 Cloud、Ultimate 和 Ultimate MT 版本，因为其他版本未暴露中继端点。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Checkmk GmbH | Checkmk | 2.5.0< 2.5.0p10 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-15576
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Agent receiver accepts mTLS requests without a client certificate
Source: CVE Program / CVE List V5
Vulnerability Description
Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only the Cloud, Ultimate and Ultimate MT editions are affected, as other editions do not expose relay endpoints.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Checkmk GmbH | Checkmk | 2.5.0 ~ 2.5.0p10 | - |
|
II. Public POCs for CVE-2026-15576
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15576
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-15576 (1)
IV. Related Vulnerabilities
Same product: Checkmk
-
CVE-2026-17548
Missing authorization for viewing background jobs -
CVE-2026-7485
Frozen BI aggregations leak host and service names to unauth -
CVE-2026-15227
Missing Authorization Allows Editing of Foreign Reports -
CVE-2026-8593
Fix Business Intelligence API Pack permission -
CVE-2026-14852
mk_sap_hana: Privilege escalation via crafted sapstartsrv pr
Same vendor: Checkmk GmbH
-
CVE-2026-17548
Missing authorization for viewing background jobs -
CVE-2026-7485
Frozen BI aggregations leak host and service names to unauth -
CVE-2026-15227
Missing Authorization Allows Editing of Foreign Reports -
CVE-2026-8593
Fix Business Intelligence API Pack permission -
CVE-2026-14852
mk_sap_hana: Privilege escalation via crafted sapstartsrv pr
Same weakness: CWE-306
-
CVE-2026-55640
Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcl -
CVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/ -
CVE-2026-55538
PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` -
CVE-2026-55534
PraisonAI serve agents --api-key is ignored, allowing unauth -
CVE-2026-55528
praisonaiagents: AgentServer declares auth_token but never e
V. Comments for CVE-2026-15576
No comments yet