Skip to content

Security

Benjamin Knapp edited this page Jul 8, 2026 · 1 revision

Security notes

This plugin makes HTTP requests from the Checkmk server to operator-configured URLs. Treat the rule as trusted input and restrict who may edit it.

SSRF: the rule is a request primitive

A URL pointing at internal services — or one that redirects there — can be used as a server-side request forgery (SSRF) vector, because the request originates from the monitoring server, inside your network.

  • Restrict who can edit the Generic JSON API ruleset.
  • Follow HTTP redirects is on by default (for back-compat). In locked-down environments, turn it off per endpoint, so a redirect to an internal address fails instead of being followed — this closes the redirect-based SSRF amplification path.

TLS

TLS verification is on by default. Disabling it (Verify the TLS certificate → off) is insecure and opt-in per rule — prefer fixing the certificate over turning verification off.

Secrets

Credentials (HTTP basic password, bearer token) are stored in the Checkmk password store and passed to the agent as a store reference, never in clear text on the command line. Create entries under Setup → Passwords.

Reporting a vulnerability

Do not open a public issue for a security problem. Report it privately via GitHub's advisory flow — see SECURITY.md.


Back to Home · Configuration.

Clone this wiki locally