CVE-2025-64998
High · 7.2CVSS
7.2
EPSS
0.3%
Published
Mar 24, 2026
CISA due date
—
The record
Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabled to hijack sessions on the central site by forging session cookies.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-116252 pgAdmin 4's materialized view refresh passed the target database's name to psql's… CWE-522
- CVE-2026-116245 libpq looks a connection service up in the service file of the operating-system account… CWE-522
- CVE-2026-116247 When a server in pgAdmin 4 had no password file, client certificate or client key… CWE-522
- CVE-2026-116244 When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials… CWE-522
- CVE-2026-116242 pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither… CWE-522
- CVE-2026-61730 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-522
- CVE-2026-111502 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected… CWE-522
- CVE-2026-119566 Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers… CWE-522