Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk versions before 2.5.0p15, 2.4.0p38, 2.3.0p51, and the EOL 2.2.0 allow an authenticated user with permission to view a host’s configuration to read stored SNMP community strings, SNMPv3 authentication and privacy pass phrases, and IPMI passwords in clear text from GET responses, although the GUI never displays these values. The exposed data can be used to gain privileged access to managed devices, compromising confidentiality and integrity.

Checkmk products prior to version 2.5.0p15, prior to 2.4.0p38, prior to 2.3.0p51, and the end‑of‑life 2.2.0 have this weakness in the host and folder configuration REST API GET endpoints.

The CVSS score of 2.3 indicates low severity, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits. However, exploitation requires an authenticated session with the appropriate viewing rights; a compromised account would allow an attacker to capture the credentials and subsequently authenticate to the target devices. The EPSS score of 0.00351 indicates the likelihood of exploitation is very low, though the long‑term validity of the stored credentials could increase risk if not patched.