CVE-2026-33457

CVE-2026-33457 is a Livestatus injection vulnerability affecting Checkmk versions prior to 2.5.0b4, 2.4.0p26, and 2.3.0p47. An authenticated user can inject arbitrary Livestatus commands through a crafted service name parameter on the prediction graph page due to insufficient input sanitization of the service description value. This vulnerability requires user authentication and network access to exploit, with low attack complexity. The vulnerability carries a CVSS score of 6.3 (Medium severity) and affects confidentiality, integrity, and availability equally, allowing attackers to read sensitive information, modify system data, and potentially disrupt service availability. The FAUCET Risk Score of 44.0 out of 100 indicates moderate overall risk, though the EPSS score of 0.0004 suggests current exploitation likelihood is extremely low relative to other CVEs. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities catalog and remains inactive on security hotlists. No publicly disclosed exploit code has been documented, and community attention appears limited at this time. Organizations running affected Checkmk versions should prioritize patching to mitigate potential unauthorized command injection attacks by authenticated users.