---
id: CVE-2026-15937
title: >-
  Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push
  agent that share the same UUID to reuse each other's mTLS certificate to
  authenticate against agent receiver endpoints in either direction, because the
  endpoi…
summary: >-
  Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push
  agent that share the same UUID to reuse each other's mTLS certificate to
  authenticate against agent receiver endpoints in either direction, because the
  endpoi…
severity: none
cwe:
  - CWE-295
published: '2026-09-04'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T14:10:24.113'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15937'
references:
  - url: 'https://checkmk.com/werk/19735'
    label: security@checkmk.com
tags:
  - nvd
epss: 0.0014
epssPercentile: 0.02738
ingestedAt: '2026-09-08T15:33:26.959Z'
---

## Overview

Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.