Checkmk: three critical fixes (Nov 11 release)

Checkmk

Checkmk's Nov 11 releases 2.5.0p19 and 2.4.0p40 fix three flaws that lead to code execution as the site user, each rated Critical (CVSS 4.0 9.4) by Checkmk: path traversal in the Robotmk test service of the commercial editions (CVE-2026-120495), argument injection in the Kubernetes special agent (CVE-2026-121374), and path traversal in…

Do this now

Update Checkmk to 2.5.0p19 or 2.4.0p40, matching your release line. 2.3 is end of life: move to 2.4.0p40 or 2.5.0p19.

Fix it

Checkmk

On 2.4.xUpgrade to Checkmk 2.4.0p40
On 2.5.xUpgrade to Checkmk 2.5.0p19
On 2.3.x2.3.0 is end of life: move to 2.4.0p40 or 2.5.0p19

We have rated the issue with a CVSS Score of 9.4 Critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and assigned CVE-2026-121374. (vendor advisory)
We have rated the issue with a CVSS Score of 9.4 CRITICAL (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and assigned CVE-2026-118965. (vendor advisory)

First seen: 11 Nov 2026
Last update: 12 Nov 2026, 14:41 UTC
Fixed in: 2.5.0p19
2.4.0p40
Identifiers: CVE-2026-118965
CVE-2026-120495
CVE-2026-121374
Source: manual

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Checkmk: three critical fixes (Nov 11 release)
Severity: critical. Patch status: patched.
Affected: Checkmk
Fixed in: 2.5.0p19, 2.4.0p40
Ids: CVE-2026-118965, CVE-2026-120495, CVE-2026-121374

Checkmk's Nov 11 releases 2.5.0p19 and 2.4.0p40 fix three flaws that lead to code execution as the site user, each rated Critical (CVSS 4.0 9.4) by Checkmk: path traversal in the Robotmk test service of the commercial editions (CVE-2026-120495), argument injection in the Kubernetes special agent (CVE-2026-121374), and path traversal in…

## Steps
1. Search the repo, its CI and infra config for Checkmk. If present, report the version in use and whether it's affected.
2. Fix by release line: Checkmk: 2.5.x → 2.5.0p19; 2.4.x → 2.4.0p40; 2.3.x → 2.3.0 is end of life: move to 2.4.0p40 or 2.5.0p19; 2.5.x → 2.5.0p19; 2.4.x → 2.4.0p40; 2.3.x → 2.3.0 is end of life: move to 2.4.0p40 or 2.5.0p19; 2.5.x → 2.5.0p19; 2.4.x → 2.4.0p40; 2.3.x → 2.3.0 is end of life: move to 2.4.0p40 or 2.5.0p19.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Checkmk 2.5.x | fixed | 2.5.0p19 | — |
| Checkmk 2.4.x | fixed | 2.4.0p40 | — |
| Checkmk 2.3.x | migrate | move to 2.4.0p40 | restrict network access to it |
| Checkmk 2.5.x | fixed | 2.5.0p19 | — |
| Checkmk 2.4.x | fixed | 2.4.0p40 | — |
| Checkmk 2.3.x | migrate | move to 2.4.0p40 | restrict network access to it |
| Checkmk 2.5.x | fixed | 2.5.0p19 | — |
| Checkmk 2.4.x | fixed | 2.4.0p40 | — |
| Checkmk 2.3.x | migrate | move to 2.4.0p40 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-118965") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://checkmk.com/werk/17994 https://checkmk.com/werk/22120 https://checkmk.com/werk/22624
https://pwned.coffee/i/checkmk-security-release-2026-11-11

Receipt

Exploitation: No known exploitation
Checked by hand “Checkmk werk 22624 (read 12 Nov 2026), the vendor advisory its CVE record links (CNA Checkmk, CVSS 4.0 9.4 CRITICAL): "We have rated the issue with a CVSS Score of 9.4 CRITICAL (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and assigned CVE-2026-120495."” source
Fix by release line: Product Affected Fixed in Source
Checkmk 2.5.0 to before 2.5.0p19 2.5.0p19 Checked by hand checked 12 Nov
Checkmk 2.4.0 to before 2.4.0p40 2.4.0p40 Checked by hand checked 12 Nov
Checkmk 2.3.0 to 2.3.0 (3 lines) 2.3.0 is end of life: move to 2.4.0p40 or 2.5.0p19 Checked by hand checked 12 Nov
Checkmk 2.5.0 to before 2.5.0p19 2.5.0p19 Checked by hand checked 12 Nov
Checkmk 2.4.0 to before 2.4.0p40 2.4.0p40 Checked by hand checked 12 Nov
Checkmk 2.5.0 to before 2.5.0p19 2.5.0p19 Checked by hand checked 12 Nov
Checkmk 2.4.0 to before 2.4.0p40 2.4.0p40 Checked by hand checked 12 Nov
Score: Severity critical, checked by hand: Checkmk werk 22624 (read 12 Nov 2026), the vendor advisory its CVE record links (CNA Checkmk, CVSS 4.0 9.4 CRITICAL): "We have rated the issue with a CVSS Score of 9.4 CRITICAL (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) and assigned CVE-2026-120495."
Last checked: 13 Nov 2026, 16:26 UTC

Product	Affected	Fixed in	Source
Checkmk	2.5.0 to before 2.5.0p19	2.5.0p19	Checked by hand checked 12 Nov
Checkmk	2.4.0 to before 2.4.0p40	2.4.0p40	Checked by hand checked 12 Nov
Checkmk	2.3.0 to 2.3.0 (3 lines)	2.3.0 is end of life: move to 2.4.0p40 or 2.5.0p19	Checked by hand checked 12 Nov
Checkmk	2.5.0 to before 2.5.0p19	2.5.0p19	Checked by hand checked 12 Nov
Checkmk	2.4.0 to before 2.4.0p40	2.4.0p40	Checked by hand checked 12 Nov
Checkmk	2.5.0 to before 2.5.0p19	2.5.0p19	Checked by hand checked 12 Nov
Checkmk	2.4.0 to before 2.4.0p40	2.4.0p40	Checked by hand checked 12 Nov

Sources: KEV – CVE record – Vendor ✓

Sources

Follow on X

Totalone very hot coffee