Checkmk installations prior to version 2.5.0p10 are affected by a flaw that allows an attacker to reuse a mutual TLS certificate issued for one agent by a different agent that shares the same UUID. The flaw stems from improper certificate validation: the recipient endpoint does not verify that the presented certificate was issued by its own root CA. As a result, an attacker can authenticate as a legitimate agent and carry out actions in either direction, potentially compromising agent data and system integrity. The weakness is a classic instance of improper certificate validation (CWE-295).

All Checkmk GmbH Checkmk installations running Checkmk < 2.5.0p10 are impacted. The vulnerability is confined to Checkmk agent receiver endpoints that rely on mutual TLS for authentication.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack is likely remotely exploitable by an adversary who can deploy a second agent with the same UUID or intercept traffic between agents. The attacker would reuse the valid certificate to authenticate to the target endpoint, achieving unauthorized agent-level access. No specific prerequisites beyond the presence of a second agent sharing the UUID are mentioned, implying a low barrier to exploitation.