Dashboard / CVE-2026-103674

CVE-2026-103674

LOW
INFO Priority: 0.00 BB Relevance: 29/100
Published: 2026-11-06 Modified: 2026-11-10 First seen: 2026-11-06 Status: active

Attack Surface

Low Complexity No Interaction

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: X
AT: Present
VC: Low
VI: None
VA: None

Description

Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.5.0 before 2.5.0p16 allows a local user on the Checkmk server to read the NetApp login password from the process list while the special agent is running. This affects both explicitly configured passwords and passwords from the password store.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Checkmk GmbH Checkmk 2.5.0 < 2.5.0p16
Checkmk GmbH Checkmk 2.5.0 < 2.5.0p16

References & Advisories (1)

Bug Bounty Relevance

29 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

2.0 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.10%
Raw Score 0.000990
Percentile 0.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00099
2026-11-12
0.00099
2026-11-10
0.00099
2026-11-09
0.00099
2026-11-08
0.00099
2026-11-07
0.00099
2026-11-06
0.00099

Intelligence Sources

mitre ref →
nvd ref →

External Links