CVE-2026-103674Low· 2.0▾ SunlitInvocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the NetApp login password from the process list while the…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 11 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.10%
Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the NetApp login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.
Checkmk >= 2.5.0 < 2.5.0p16Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103682Low· 2.0Jolokia special agent exposes password in process list
CVE-2026-111573Medium· 6.3Privilege escalation via unprotected Windows agent data folder
CVE-2026-117611High· 7.1Trust of compromised eMudhra root CA in bundled CA stores
CVE-2026-113461Medium· 5.2mk-oracle: Local privilege escalation via insecure Oracle Home library loading
CVE-2026-14452High· 8.6Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup acces…
CVE-2026-105331Medium· 5.2Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.