External risk intelligence

Checkmk Path Traversal Allows Arbitrary File Write and Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-118965

The vulnerability exists within the synchronization mechanism between distributed monitoring sites in a Checkmk environment. While network-reachable, this communication typically occurs over private management networks or VPN tunnels between internal infrastructure nodes rather than via public-facing internet endpoints.

Path Traversal

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A path traversal vulnerability has been identified in the discovered host label synchronization feature of Checkmk, potentially allowing an attacker to write arbitrary files on a central monitoring site and execute code. This issue affects specific versions of Checkmk, primarily in distributed monitoring setups. The main concern at this time is confirming relevance and exposure within your environment.

Attackers can write files and run code remotely.
Matters for those using distributed monitoring setups.
Confirm if your Checkmk setup is affected.

Attack Path

How an attacker could exploit the issue

An attacker with control over a remote Checkmk site in a distributed setup can exploit a path traversal vulnerability. This allows them to write arbitrary files to the central monitoring site, potentially leading to code execution with the privileges of the central site user.

Network access to a remote site required.
Vulnerability triggered via discovered host label synchronization.
Risk of arbitrary file write and code execution.

Live Threat

Current exploitation, exposure, and threat context

An attacker controlling a remote Checkmk site could write arbitrary files to the central site's file system. This could allow for code execution with the privileges of the central site user, provided the conditions for synchronization are met.

Arbitrary file writes on the central site.
Via compromised remote site synchronization.
Potential for code execution on central site.

Operational Fix

Recommended remediation, mitigation, and detection steps

In a distributed monitoring setup, the Platform or Infrastructure team managing the central Checkmk site, and potentially the Application owners of the monitored services, are likely responsible for addressing this vulnerability. The first practical step is to identify all Checkmk central sites, confirm their network exposure and business criticality, and then locate the accountable owner to plan remediation.

Platform or Infrastructure teams own remediation.
Verify Checkmk central site exposure and criticality.
Plan coordinated updates or mitigating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Checkmk?

Checkmk is an IT infrastructure monitoring software used to track the health and performance of servers, networks, and applications. It supports distributed monitoring, where a central site aggregates data from multiple remote sites to provide a unified view of complex, large-scale environments.

What does CVE-2026-118965 mean for security?

This vulnerability is a path traversal flaw, classified as CWE-22. It happens when an application fails to properly validate file paths. In this specific case, the bug allows an attacker to manipulate file synchronization processes to write unauthorized files onto a system, which can then be leveraged to execute malicious code with the central site user's permissions.

How is this vulnerability triggered?

An attacker must already have control over a remote site within a distributed Checkmk setup to initiate the attack. The vulnerability is triggered during the synchronization of discovered host labels. It is not triggered by standard monitoring activities or by simply having network access to the site without established site-to-site communication.

Is my Checkmk instance at risk?

Risk is limited to distributed monitoring architectures where a central site communicates with remote sites. According to Halo Surface Signal, although the vulnerability is network-reachable, this specific synchronization traffic typically moves over private management networks or VPNs, making it less likely to be exposed directly to the public internet.

What should I do if I use Checkmk?

First, identify if your architecture utilizes a distributed monitoring setup with central and remote sites. If so, work with your infrastructure team to verify the versions in use against the affected range. Prioritize identifying these central sites to assess their connectivity and plan for the vendor-recommended software updates.

References

checkmk.com/werk/22120

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.