CVE-2026-103682 Details
Description
Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the Jolokia login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.
A vulnerability in Checkmk versions 2.5.0 prior to 2.5.0p16 allows local users to read the Jolokia login password from the process list while the special agent is running. This issue arises because the password is invoked in plain text on the command line, exposing both explicitly configured passwords and those from the password store. The vulnerability affects all Checkmk editions that monitor Jolokia with a configured login.
Users can upgrade to Checkmk version 2.5.0p16 or later, where this vulnerability has been addressed. The update is compatible with all Checkmk editions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://checkmk.com/werk/22409 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-214 | Invocation of Process Using Visible Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Checkmk | 2.5.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |