CVE-2024-8606 is a two factor authentication bypass in the RestAPI of Checkmk. The record rates it High (CVSS 3.1 score 8.8). It affects Checkmk 2.3.0 before 2.3.0p16 and 2.2.0 before 2.2.0p34. The fix is to update to 2.3.0p16, 2.2.0p34 or a later patch release.
What's affected
The NVD record says the issue covers Checkmk before 2.3.0p16 and before 2.2.0p34. The vendor note, Werk #16218, lists the affected versions as 2.3.0 and 2.2.0 and names the fixed releases as 2.4.0b1, 2.3.0p16 and 2.2.0p34. It applies to the Community, Pro, Ultimate and Ultimate MT editions. The Cloud edition is listed only for 2.4.0b1.
The Werk dates the fix to 9 September 2024. The CVE was published on 23 September 2024. The vulnerable code is the RestAPI, not the web login page, so the exposure depends on whether your API is reachable and which users have two factor authentication turned on.
There is a severity difference to be aware of. The CVE record carries a CVSS 3.1 score of 8.8 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The Checkmk Werk rates the same issue 9.2 Critical using CVSS 4.0, with the vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The two scoring systems weigh things differently. Treat it as a high priority fix either way.
The record does not flag this CVE as exploited in the wild, and it is not in CISA's Known Exploited Vulnerabilities list.
How to check if you're exposed
Find your Checkmk version first. On the monitoring server, as the site user, run:
omd version
Compare the result with the patch levels above. Any 2.2.0 build older than p34, or any 2.3.0 build older than p16, is in scope.
Then work out whether the RestAPI is reachable. Check who can reach the site over the network, and whether any reverse proxy exposes the API path. Finally, list the accounts that have two factor authentication enabled. Those are the users for whom the weakness matters, because the flaw is about an API request being accepted without the second factor.
If you track software in a bill of materials, a free in-browser dependency scan can help you spot other components in the same estate, and the Gold page for this CVE keeps the record details in one place.
What to do now
- Update every Checkmk site to 2.3.0p16, 2.2.0p34 or newer. The Werk marks the change as compatible, with no manual interaction needed.
- Restrict network access to the RestAPI to the hosts that need it, such as automation servers and admin workstations.
- Review API activity on the affected sites since the first vulnerable build was deployed. Look for logins from accounts that normally use two factor authentication but show API access from unfamiliar addresses.
- Rotate automation secrets and passwords for privileged accounts if you see anything unexpected.
- Read the Checkmk Werk and confirm the exact patch level for your edition.
Why it matters
The record classifies the weakness as CWE-863, incorrect authorization. According to the Werk, the RestAPI did not properly check whether a user who is supposed to authenticate with multiple factors had actually authenticated fully. In plain terms, one step of the login was enforced on one path and not on another.
This matters because a monitoring system sees a lot. It knows your hosts, services and credentials for checks, and administrators can often change its configuration. An attacker who already holds a valid password but not the second factor can use this gap to get what the second factor was meant to block. The vendor says the issue was found during internal review. The record requires a low privilege account, which is why the 3.1 vector shows PR:L.
The general lesson applies beyond Checkmk. Every route into an application, including APIs, needs the same authentication checks as the web interface.
Quick check
Does an attacker need a valid account to use CVE-2024-8606?
The NVD description says it allows authenticated users to bypass two factor authentication, and the CVSS 3.1 vector lists low privileges required. The CVSS 4.0 vector in the Checkmk Werk lists no privileges required, so read the advisory for your setup.
Which versions fix it?
Checkmk 2.3.0p16, 2.2.0p34 and 2.4.0b1, according to Werk #16218. Newer patch releases of those branches should also be fine, but confirm against the vendor page.
Sources
Last reviewed: 19 October 2026.
