CVE-2026-24097CWE-204

Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint

Medium · published March 13, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows authenticated users to enumerate existing hosts by observing different HTTP response codes in agent-receiver/register_existing endpoint, which could lead to information disclosure.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00246 · 15.0th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2026-03-13T09:40Z
EPSS history
Timeline
  • 13 MAR 09:40Z
    Authenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint
    cvelistv5