CVE-2026-33456 Potential livestatus injection in notification test
Authenticated users can inject arbitrary Livestatus commands via crafted service descriptions in the notification test mode, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33456?
CVE-2026-33456 is a medium-severity code injection vulnerability in Checkmk Checkmk, published on 10 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with access to the notification test page to inject arbitrary Livestatus commands via a crafted service description.
Weakness: CWE-140
Which versions are affected by CVE-2026-33456?
It affects 1 product.
Products include Checkmk Checkmk.
How do I fix CVE-2026-33456?
No fix has been published for CVE-2026-33456 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-33456 being exploited?
There is no known exploitation of CVE-2026-33456 in the wild and no public exploit code.
Other vulnerabilities in Checkmk Checkmk
- CVE-2025-39666 omd: Local privilege escalation when executing omd commands as root
- CVE-2024-8606 Fix 2FA bypass via RestAPI
- CVE-2022-46836 PHP code injection in watolib
- CVE-2025-32919 Privilege Escalation in Windows License plugin for Checkmk Windows Agent
- CVE-2024-28827 Privilege escalation in Windows agent
Sources
Also known as GHSA-hxwv-vc7p-p66g, UBUNTU-CVE-2026-33456.