Description
Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the Jolokia login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.
Published: 2026-11-06
Score: 2 Low
EPSS: n/a
KEV: No
Impact: Local password disclosure via process list
Action: Patch Upgrade
AI Analysis

Impact

The Jolokia special agent, when invoked with a login password supplied on the command line in Checkmk versions 2.5.0 through 2.5.0p15, writes that password into the process table. A local user on the Checkmk server can therefore read the Jolokia login password from the process list while the agent is executing. This allows the attacker to obtain credentials that may be used to authenticate to other services or services running under the same account. The weakness is a form of information exposure (CWE-214).

Affected Systems

Checkmk GmbH Checkmk, specifically server releases 2.5.0 to 2.5.0p15. The vulnerability affects both passwords configured explicitly in the agent and those retrieved from the Checkmk password store.

Risk and Exploitability

The CVSS score of 2 indicates a low severity assessment, and no EPSS score is available. KEV does not list this vulnerability. The attack vector is local: a user with sufficient privileges to view the process table can harvest the password. While the exploit probability is low, any local user could compromise the credentials, so remediation is advised.

Generated by OpenCVE AI on November 6, 2026 at 10:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Checkmk to version 2.5.0p16 or newer, which removes the password from the command line argument
  • Configure the Jolokia special agent to use credentials from the password store or a secured configuration file, ensuring passwords are never passed as command line parameters
  • Restrict local user permissions so that only trusted administrators can view process listings, limiting the exposure of runtime command lines

Generated by OpenCVE AI on November 6, 2026 at 10:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://checkmk.com/werk/22409 cve-icon cve-icon
History

Fri, 06 Nov 2026 09:15:00 +0000

Type Values Removed Values Added
Description Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the Jolokia login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.
Title Jolokia special agent exposes password in process list
First Time appeared Checkmk
Checkmk checkmk
Weaknesses CWE-214
CPEs cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*
Vendors & Products Checkmk
Checkmk checkmk
References
Metrics cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L'}

Subscriptions

Checkmk Checkmk
cve-icon MITRE

Status: PUBLISHED

Assigner: Checkmk

Published:

Updated: 2026-11-06T09:07:55.856Z

Reserved: 2026-10-01T09:19:30.801Z

Link: CVE-2026-103682

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-06T09:16:59.360

Modified: 2026-11-06T09:16:59.480

Link: CVE-2026-103682

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T10:30:18Z

Weaknesses
  • CWE-214

    Invocation of Process Using Visible Sensitive Information