CVE-2026-2859CWE-204

Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint

Medium · published March 13, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
24.9
In the wild
Unconfirmed
What it is

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p23, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows unauthenticated users to enumerate existing hosts by observing different HTTP response codes in deploy_agent endpoint, which could lead to information disclosure.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00330 · 24.9th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2026-03-13T09:40Z
EPSS history
Timeline
  • 13 MAR 09:40Z
    Unauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint
    cvelistv5