High severity · published Oct 29, 2026
CVE-2026-117611
Trust of compromised eMudhra root CA in bundled CA stores
New
7.1
CVSS
–
EPSS
No
On KEV
Description
Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Certificate Authority stores bundled with "certifi" and "webpki-roots" include a root CA that trusts eMudhra (emSign) intermediate certificates whose private keys are public.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Checkmk · Checkmk GmbH
2.5.0 before 2.5.0p18; 2.4.0 before 2.4.0p39; 2.3.0 before 2.3.0p52; 2.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117611
vendor-advisory
https://checkmk.com/werk/22623
vendor-advisory
https://checkmk.com/werk/22169
third-party-advisory
https://github.com/advisories/GHSA-6q48-6c7w-9gw2
More from Checkmk
8.8
CVE-2026-24096
Insufficient permission validation on multiple REST API Quick Setup endpoints
8.8
CVE-2025-32918
Livestatus injection in autocomplete endpoint
8.8
CVE-2025-1712
Arbitrary file write with vcrtrace
8.8
CVE-2025-32917
Privilege escalation in jar_signature
8.8
CVE-2024-38865
Livestatus command injection in RestAPI