CVE-2026-7186: Fix stored XSS in URL dashboard widget via dangerous URI schemes

Synopsis

Stored cross-site scripting (XSS) in the URL dashboard widget of Checkmk allows a user with dashboard editing permissions to embed a malicious URI scheme (such as javascript:) into a widget URL. The attack is delivered over the network and requires a low-privilege account to plant the payload, but a separate user must subsequently view the affected dashboard for the script to execute. Successful exploitation gives the attacker full control over the victim user's browser session within Checkmk, including the ability to read and modify data accessible to that user. Patched-image rebuilds at versions 2.3.0p48, 2.4.0p31, and 2.5.0p5 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Checkmk web interface over the network to plant the payload and the victim must load the dashboard from a network-accessible instance.

• AuthenticationRequired

  A low-privilege account with dashboard editing permissions is sufficient to store the malicious URL; no administrative access is needed.

• Victim interactionRequired

  A separate authenticated user must open the compromised dashboard in their browser for the injected script to execute, making this a social-engineering or opportunistic attack on active Checkmk users.

• Attack complexityDetail

  Attack complexity is low; no race conditions or special environmental conditions are required, and the exploit is reliable once the payload is stored.

Blast Radius

• Reads session tokens, cookies, and any data visible in the victim user's Checkmk browser context, which may include host and service monitoring data.
• Performs actions in Checkmk on behalf of the victim user, including modifying dashboards, acknowledging alerts, or changing configuration objects the victim has permission to edit.
• Exfiltrates credentials or API keys if the victim user's browser has them cached or auto-filled within the Checkmk interface.
• Degrades monitoring visibility for the victim user's session by manipulating displayed dashboard content.