CVE-2026-117611 Details
Description
Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Certificate Authority stores bundled with "certifi" and "webpki-roots" include a root CA that trusts eMudhra (emSign) intermediate certificates whose private keys are public.
A vulnerability exists in Checkmk versions through 2.4.0p39, 2.3.0p52, and 2.2.0 (EOL) due to improper certificate validation. The issue arises because the Certificate Authority stores bundled with 'certifi' and 'webpki-roots' include a root CA that trusts eMudhra (emSign) intermediate certificates, which have compromised private keys. This vulnerability allows an attacker with access to one of the compromised keys to issue valid-looking certificates for any hostname, potentially intercepting or modifying TLS traffic from clients that trust the certifi bundle.
Users are advised to upgrade to Checkmk versions 2.5.0p18, 2.4.0p39, or 2.3.0p52. For those using Checkmk 2.2.0, which is no longer supported, an upgrade to a newer version is recommended.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://checkmk.com/werk/22169 | [email protected] | AdvisoryVendor |
| https://checkmk.com/werk/22623 | [email protected] | AdvisoryRemedyVendor |
| https://github.com/advisories/GHSA-6q48-6c7w-9gw2 | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Checkmk | < 2.5.0p18 < 2.4.0p39 < 2.3.0p52 2.2.0 (semver) |
CPE
Remediation
| |
| Checkmk Community | < 2.5.0p18 < 2.4.0p39 < 2.3.0p52 2.2.0 (semver) |
CPE
Remediation
| |
| Checkmk Pro | < 2.5.0p18 < 2.4.0p39 < 2.3.0p52 2.2.0 (semver) |
CPE
Remediation
| |
| Checkmk Ultimate | < 2.5.0p18 < 2.4.0p39 < 2.3.0p52 2.2.0 (semver) |
CPE
Remediation
| |
| Checkmk Cloud | < 2.5.0p18 < 2.4.0p39 < 2.3.0p52 2.2.0 (semver) |
CPE
Remediation
| |
| Checkmk Ultimate MT | < 2.5.0p18 < 2.4.0p39 < 2.3.0p52 2.2.0 (semver) |
CPE
Remediation
| |
| Checkmk check_httpv2 | All versions |
CPE
Remediation
| |
| certifi | >= 2019.03.09, < 2026.10.19 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |