CVE-2024-47092 is a critical severity (CVSS 9.8) flaw in the Checkmk Exchange plugin check-mk-api. The record describes insecure deserialization and improper certificate validation in versions prior to 5.8.1. Update the plugin, and check any scripts that use it to talk to a Checkmk site.
What's affected
The record names the Checkmk Exchange plugin check-mk-api, listed under the product check_mk_python_api, and says versions prior to 5.8.1 are affected. The fix is version 5.8.1 or later.
The Exchange page for the package currently lists a latest version of 6.4.0, uploaded 20 July 2026, with a stated minimum Checkmk version of 2.4.0b1. Check that your Checkmk version supports the release you move to.
This is a community plugin distributed through the Checkmk Exchange, not part of the core Checkmk product.
How to check if you're exposed
Look for the plugin in your Checkmk site and in any scripts or automation that import it.
grep -rn "check_mk_api\|check-mk-api" /opt /usr/local /etc 2>/dev/null | head
pip list 2>/dev/null | grep -i check
If the plugin was installed as an MKP package, list installed packages in your Checkmk site with the mkp tool and read the version. Also look at the code that calls the API: if it disables certificate checks, fix that regardless of this CVE.
What to do now
- Find every place the check-mk-api plugin is installed or imported.
- Update to 5.8.1 or later, and test against your Checkmk version.
- Make sure API calls verify the TLS certificate of the Checkmk server.
- Restrict which hosts the automation can talk to, and keep API credentials in a secret store.
- Review how the plugin is invoked by cron or CI, and who can change those jobs.
Why it matters
The first weakness is CWE-502 (Deserialization of Untrusted Data). Deserialization turns stored or transmitted bytes back into objects, and if the format can carry code or object types chosen by the sender, the receiver may run attacker controlled logic. The second weakness, improper certificate validation, means the client may talk to something other than the real server. Together, a person in the network path could feed crafted data to a client that trusts it.
The 9.8 score comes from a network vector with no privileges needed and no user interaction. Monitoring tooling often runs with broad access to servers, so a flaw in its helper libraries deserves attention. The record does not say this was exploited, and it is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-47092.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2024-47092?
The record says versions prior to 5.8.1 are affected, so 5.8.1 or later.
Is this part of Checkmk itself?
No. It is a plugin from the Checkmk Exchange, so it is updated separately from the core product.
Sources
Last reviewed: 19 October 2026.
