CVE-2026-33457CWE-140

Potential livestatus injection in prediction graph page

Medium · published April 10, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated user to inject arbitrary Livestatus commands via a crafted service name parameter due to insufficient sanitization of the service description value.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00175 · 7.1th percentile
Weakness
CWE-140 · Improper Neutralization of Delimiters
Published
2026-04-10T08:31Z
EPSS history
Timeline
  • 10 APR 08:31Z
    Potential livestatus injection in prediction graph page
    cvelistv5