CVE-2026-24097 — Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint

CVE-2026-24097

Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint PUBLISHED

Description (CNA)

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows authenticated users to enumerate existing hosts by observing different HTTP response codes in agent-receiver/register_existing endpoint, which could lead to information disclosure.

Affected (CNA)

Vendor / product	Versions
Checkmk GmbH / Checkmk	affected 2.4.0 before 2.4.0p23; affected 2.3.0 before 2.3.0p43; affected 2.2.0

CWE

CWE-204

References

https://checkmk.com/werk/18993

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.