CVE-2026-92882— Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses
Quick assessment
Affected
Checkmk GmbH Checkmk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk <2.5.0p15, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an authenticated user who may view a host's configuration to read stored SNMP community string
Affected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Checkmk GmbH | Checkmk | 2.5.0< 2.5.0p15 |
affected |
2.4.0< 2.4.0p37 |
affected | ||
2.3.0< 2.3.0p51 |
affected | ||
2.2.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92882
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk <2.5.0p15, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases and IPMI passwords in clear text from GET responses, although the setup GUI never displays these values.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Checkmk GmbH | Checkmk | 2.5.0 ~ 2.5.0p15 | - |
|
II. Public POCs for CVE-2026-92882
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92882
请登录查看更多情报信息。
Other References for CVE-2026-92882 (1)
IV. Related Vulnerabilities
Same product: Checkmk
-
CVE-2026-90990
Livestatus injection via monitoring filter values -
CVE-2026-77021
Missing decompression size limit in agent receiver allows me -
CVE-2026-15937
Agent receiver certificate confusion allows authentication w -
CVE-2026-17548
Missing authorization for viewing background jobs -
CVE-2026-15576
Agent receiver accepts mTLS requests without a client certif
Same vendor: Checkmk GmbH
-
CVE-2026-90990
Livestatus injection via monitoring filter values -
CVE-2026-77021
Missing decompression size limit in agent receiver allows me -
CVE-2026-15937
Agent receiver certificate confusion allows authentication w -
CVE-2026-17548
Missing authorization for viewing background jobs -
CVE-2026-15576
Agent receiver accepts mTLS requests without a client certif
Same weakness: CWE-522
-
CVE-2026-48976
HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr -
CVE-2026-89064
All-in-One WP Migration and Backup <= 7.110 - Unauthenticate -
CVE-2026-92759
SecObserve before 1.59.1 Information Disclosure via API Conf -
CVE-2026-20234
Cisco Identity Services Engine Hardening Release - Insuffien -
CVE-2026-92256
Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure
V. Comments for CVE-2026-92882
No comments yet