CVE-2026-14452 Details
Description
Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.
A vulnerability allowing cross-site scripting (XSS) and open redirect has been identified in the Checkmk Setup component, affecting versions prior to 2.5.0p15, 2.4.0p38, 2.3.0p51, and 2.2.0 (EOL). The issue arises from improper validation of the reset_url parameter in the in-page search. An attacker could exploit this vulnerability by crafting a URL with a malicious reset_url value, which could either execute arbitrary scripts in the session of an authenticated user with Setup access or redirect the user to an external site. Exploitation requires the user to click the Reset button or submit an empty search.
Users can update to Checkmk versions 2.5.0p15, 2.4.0p38, 2.3.0p51, or 3.0.0b1 to address this vulnerability. Instructions for updating can be found on the Checkmk website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://checkmk.com/werk/22314 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Checkmk | >= 2.5.0, < 2.5.0p15 >= 2.4.0, < 2.4.0p38 >= 2.3.0, < 2.3.0p51 2.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |