CVE-2026-15576 Agent receiver accepts mTLS requests without a client certificate
Unauthenticated attackers can bypass mTLS verification on Checkmk relay endpoints by using a placeholder identity, affecting specific enterprise editions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15576?
CVE-2026-15576 is a medium-severity authentication bypass vulnerability in Checkmk, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only the Cloud, Ultimate and Ultimate MT editions are affected, as other editions do not expose relay endpoints.
Weakness: CWE-306
Which versions are affected by CVE-2026-15576?
How do I fix CVE-2026-15576?
No fix has been published for CVE-2026-15576 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-15576 being exploited?
There is no known exploitation of CVE-2026-15576 in the wild and no public exploit code.
Sources
Also known as GHSA-8fww-64wc-46pf, UBUNTU-CVE-2026-15576.