---
cve: "CVE-2026-3466"
severity: "HIGH"
cvss: 8.5
epss: "23%"
vendor: "Checkmk GmbH"
kev: false
exploited: false
published: "2026-04-07 13:16:47"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-03T07:50:57+02:00"
---

# CVE-2026-3466

> 8.5 HIGH

## Beschreibung

Insufficient sanitization of dashboard dashlet title links in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0 allows an attacker with dashboard creation privileges to perform stored cross-site scripting (XSS) attacks by tricking a victim into clicking a crafted dashlet title link on a shared dashboard.

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |

## Referenzen

- <https://checkmk.com/werk/19033>
- <https://checkmk.com/werk/19583>
- <https://www.vulncheck.com/advisories/checkmk-stored-cross-site-scripting-in-dashlet-title>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-3466) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_