Description
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response includes the secret field used by HttpProvider.ts as an HTTP Authorization credential, even though BaseStatusPage.tsx does not display that value, allowing visitors to extract credentials from the JSON response and use them against monitored services. This issue is fixed in version 3.9.2.
Published: 2026-08-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive bearer token exposure
Action: Patch Immediately
AI Analysis

Impact

The vulnerability arises when the global showURL setting is enabled, allowing an unauthenticated GET request to /api/v1/status-page/:url to return the full monitor object in JSON, including the secret field used as an HTTP Authorization credential. Attackers can read the bearer token from the response and use it to authenticate against monitored services, constituting a confidentiality breach and credential exposure.

Affected Systems

The affected product is Checkmate by bluewave‑labs. Versions from 3.3.0 up to but excluding 3.9.2 are impacted. The flaw is resolved in Checkmate 3.9.2 and later releases.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. EPSS is not available and the vulnerability is not listed in CISA's KEV catalog. Attackers can exploit the flaw by accessing the public or internal /api/v1/status-page/:url endpoint without authentication; the exposed bearer token provides full access to monitored services.

Generated by OpenCVE AI on August 21, 2026 at 19:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Checkmate to v3.9.2 or later.
  • Disable the global showURL setting to prevent unauthenticated status-page exposure.
  • Implement authentication or rate limiting on the /api/v1/status-page/:url endpoint to restrict access.

Generated by OpenCVE AI on August 21, 2026 at 19:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Bluewave-labs
Bluewave-labs checkmate
Vendors & Products Bluewave-labs
Bluewave-labs checkmate

Fri, 21 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Description Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response includes the secret field used by HttpProvider.ts as an HTTP Authorization credential, even though BaseStatusPage.tsx does not display that value, allowing visitors to extract credentials from the JSON response and use them against monitored services. This issue is fixed in version 3.9.2.
Title Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled
Weaknesses CWE-200
CWE-522
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Bluewave-labs Checkmate
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-21T21:43:42.303Z

Reserved: 2026-08-07T18:26:53.524Z

Link: CVE-2026-71862

cve-icon Vulnrichment

Updated: 2026-08-21T21:09:31.938Z

cve-icon NVD

Status : Received

Published: 2026-08-21T18:16:50.730

Modified: 2026-08-21T22:16:43.993

Link: CVE-2026-71862

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T20:00:13Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-522

    Insufficiently Protected Credentials