CVE-2026-8833: XSS in urls

Synopsis

Cross-site scripting (XSS) in Checkmk's URL validation function allows an authenticated attacker to inject malicious URLs, such as javascript: URIs, by bypassing HTML-encoded character checks. The vulnerability is reachable over the network and requires a low-privilege account to craft the payload; a second user must then interact with the crafted link for the script to execute. Successful exploitation gives the attacker full read and write access to the victim's session context, and can disrupt the victim's access to the Checkmk interface. Patched-image rebuilds at versions 2.3.0p48, 2.4.0p31, and 2.5.0p5 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Checkmk web interface over the network to submit a crafted URL payload.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must be authenticated to access the URL input function where the injection occurs.

• Victim interactionRequired

  A second user must click or otherwise interact with the attacker-crafted link for the injected script to execute in their browser.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the crafted link is delivered; no race conditions or special environmental factors are required.

Blast Radius

• Reads the victim user's active session tokens, cookies, and any data visible in their Checkmk browser context.
• Modifies Checkmk configuration or monitoring data on behalf of the victim, using their session privileges.
• Crashes or disrupts the victim's Checkmk interface session, preventing access to monitoring dashboards and alerts.
• Writes limited data to systems in Checkmk's secondary scope (SI:L), such as modifying non-critical cross-site resources reachable through the victim's session.