A checkmk configuration signing secret is exposed in versions prior to 2.4.0p23, 2.3.0p45 and the 2.2.0 release. Armed with this secret an administrator who has access to a remote site that participates in configuration synchronization can forge session cookies for the central site. The forged cookies grant the attacker full access to the central instance, effectively hijacking any authenticated session and enabling them to view, modify or delete data and configuration across the monitored environment. This vulnerability enables unauthorized credential misuse and could lead to complete compromise of the central management system.

The affected product is Checkmk by Checkmk GmbH. Versions impacted are any releases prior to 2.4.0p23, prior to 2.3.0p45 and the 2.2.0 release. All older releases of the product are considered vulnerable unless they have been upgraded beyond the stated thresholds.

The CVSS score of 7.3 classifies the flaw as high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, yet the necessary conditions for exploitation—access to a remote site with configuration sync enabled—are realistic for operators that manage distributed deployments. An attacker who controls one node can generate valid session tokens for the central node, a direct path to privilege escalation and data disclosure. The risk remains significant for organizations maintaining distributed Checkmk installations without immediately applying the patch.