Critical CVE in checkmk 2.5.0 docker image

Troubleshooting
1

CMK version: 2.5.0
OS version: docker

Hello all,

Very excited to see checkmk 2.5.0 is out!

I was ready to deploy it, but out container image scanning blocks the image as it has found three critical CVE’s.

the following are reported:

CVE-2025-68121 (stdlib)
CVE-2025-68121 (stdlib)
CVE-2026-33186 (Golang grpc)

Is this a known issue?

Thanks and regards,
Wme

2

Known. We are not affected.
We updated the respective component nevertheless. Will come in the next patch release.

Have to check with the team.

3

Thanks for your quick reply Martin. Good to hear grpc will be updates, also hope that is the case for stdlib. Thanks for all your great work!

4

stdlib will be tackled as well. Should also come with next patch release.

1 Like
5

Hi @martin.hirschvogel ,

I see 2.5.0p1 is out, but our container scanning still reports all three CVE’s as being present. Do you know if the fixes/updates did not make the cut to p1?

Thanks again,
Wme

6

Hi,
CVED-2026-33186 should definitely be fixed with this.

The other one is pending.

7

Thanks again @martin.hirschvogel ,

Our scanner is still picking up on it though, with the p1 build I still see:

image
image2282×205 27.4 KB

8

Pretty sure something is wrong with your scanner then, e.g. cached results.
OTel Collector is at 0.149.0 and gRPC is at 1.79.3

9

I removed all possible cache sources (we use Harbor as proxy and GitLab as build registry) and also ran the build itself (as we add some internal CA’s) without any cache… the scanner still reports those same issues, also on a fresh scan.

I can’t see there an issue on my side, I will dig some more and try the steps on a clean development workstation.

Thanks,
Wme

10

Dug deeper… from the scans I see these following three binaries cause the critical:

  • opt/omd/versions/2.5.0p1.community/share/check_mk/agents/robotmk/windows/rcc.exe
  • opt/omd/versions/2.5.0p1.community/share/check_mk/agents/robotmk/linux/rcc
  • opt/omd/versions/2.5.0p1.community/bin/jaeger

How did I find this?

On a clean workstation I installed Rancher Desktop and trivy (both latest versions).

Then running “trivy image checkmk/check-mk-community:2.5.0p1” I get close to the results I see in our company scanner, including the 3 issues that block deployment.

Removing the three binaries from our custom build I run on top op the official checkmk community 2.5.0p1, now there are no more criticals in this build.

There are still 15 high’s reported. I am however allowed to use this for out PoC. So that is good.

As follow up though… For us this does mean a blocker for production deployments as containers with high and critical rated vulnerabilities won’t start.

I hope this does help , as I am super hyped we are allowed to push to use CheckMK internally. For us this is a new development. Thank you again for your support!

Cheers,
Wme

11

Hi, thanks for the diving deeper! I appreciate that. I will forward it to our security team.

12

CVE-2025-68121 (stdlib) should be solved by this

Coming with next patch release.
We are still looking into the other binaries

13

Hi @martin.hirschvogel ,

Sorry to bump this thread. I just checked the status in 2.5.0p3, there are still criticals in there. Also now some new ones regarding Python.

But the previous 3 mentioned files are still an issue.

Any updates from your security team?

Thanks again,
Wme

14

Hi @WMe ,

the updates for Jaeger and rcc are expected in 2.5.0p4, which will be released in the next days.

Regards,
Hannes

15

p4 is out now. Let us know if the scanners still get triggered