CVE-2026-15937CWE-295

CVE-2026-15937

published September 4, 2026

CVSS
5.3
EPSS
0%
Percentile
3.1
In the wild
Unconfirmed
What it is

Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00140 · 3.1th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-09-04T13:17Z
References (1)
https://checkmk.com/werk/19735 · [email protected]
EPSS history
Timeline
  • 05 SEP 03:40Z
    EPSS moved — → 0%
    epss
  • 04 SEP 08:24Z
    Agent receiver certificate confusion allows authentication with a certificate issued for another endpoint
    cvelistv5