CVE-2026-2859 — Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint

CVE-2026-2859

Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint PUBLISHED

Description (CNA)

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in deploy_agent endpoint, which could lead to information disclosure.

Affected (CNA)

Vendor / product	Versions
Checkmk GmbH / Checkmk	affected 2.4.0 before 2.4.0p23; affected 2.3.0 before 2.3.0p43; affected 2.2.0

CWE

CWE-204

References

https://checkmk.com/werk/18994

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.