External risk intelligence

Checkmk Robotmk Path Traversal Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-120495

The vulnerability exists in a monitoring service component (Robotmk) that processes agent output from monitored hosts. While the Checkmk server itself may be reachable, this specific attack vector requires the attacker to first control the agent output on a monitored host, which is a specialized internal configuration step rather than a directly internet-exposed surface.

Path Traversal

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a path traversal vulnerability within the Synthetic Monitoring "Robotmk" test service of Checkmk. The issue allows for code execution if an attacker can control the agent output from a monitored host, leading to the manipulation of generated HTML logs. The main concern is to confirm if this specific technology is in use and assess potential exposure.

Path traversal allows code execution via crafted monitoring data.
Leadership should remember this impacts monitoring systems.
Confirm relevance and exposure to Checkmk monitoring.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by first gaining control over the agent output of a monitored host. This allows them to inject crafted data into the "Robotmk" test service, which can then be used to define where and what content is written to HTML logs, ultimately leading to code execution on the server.

Attacker must control agent output.
Crafted robot output triggers vulnerability.
Risk of code execution.

Live Threat

Current exploitation, exposure, and threat context

A path traversal vulnerability in the Synthetic Monitoring \"Robotmk\" test service could allow for code execution as the site user. This is possible when an attacker controls the agent output of a monitored host's check output and injects crafted robot output.

System files and service behavior.
Crafted agent output injection.
Code execution as site user.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Synthetic Monitoring service in Checkmk is susceptible to a path traversal vulnerability that could lead to code execution. System owners should prioritize identifying all instances of the affected Checkmk service, confirming their reachability and business criticality, and then assigning ownership for remediation planning.

Application and Infrastructure teams own remediation.
Verify agent output control and service reachability.
Plan remediation based on identified exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Checkmk Robotmk component?

Checkmk is a comprehensive IT monitoring platform used to track the health and performance of servers and network infrastructure. The Robotmk service is a specialized component within Checkmk designed for Synthetic Monitoring, which allows administrators to run automated Robot Framework tests to simulate user interactions and verify application availability.

How does CVE-2026-120495 work?

This vulnerability is a path traversal, classified as CWE-23. It occurs when an application fails to properly sanitize file path inputs. In this case, the Robotmk service processes data from monitored hosts; if that data is malicious, it can trick the service into writing files to unauthorized locations, which ultimately allows the attacker to execute code with the permissions of the Checkmk site user.

Do I need to be worried about direct internet attacks?

Not necessarily. The vulnerability does not trigger just because a server is reachable over the network. An attacker must first gain control over the agent output of a host that is being monitored by your Checkmk instance. If the attacker cannot influence the data reported by a monitored host, the Robotmk service will not process the malicious payload required to trigger this bug.

How do I determine if this affects me?

According to Halo Surface Signal, this vulnerability is classified as unlikely for many because it requires a specific, multi-stage attack path rather than a simple public-facing exploit. You should evaluate your environment by checking if you use the Robotmk synthetic monitoring feature and identifying which hosts are configured to send their output to your Checkmk server.

What should I do first to manage this risk?

Begin by identifying all Checkmk installations in your environment that utilize the Robotmk service. Once identified, verify your patch status against the affected versions listed in the advisory. If you cannot update immediately, focus on securing the communication between your monitored hosts and the Checkmk server to ensure that agent output cannot be intercepted or tampered with by unauthorized parties.

References

checkmk.com/werk/22624

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.