Description

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response includes the secret field used by HttpProvider.ts as an HTTP Authorization credential, even though BaseStatusPage.tsx does not display that value, allowing visitors to extract credentials from the JSON response and use them against monitored services. This issue is fixed in version 3.9.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-21T18:16:50.730Z",
  "pubdate": "2026-08-21T18:16:50.730Z",
  "executiveSummary": "Checkmate versions 3.9.0 through 3.9.1 suffer from an unauthenticated sensitive information disclosure vulnerability affecting monitor objects exposed via the status page API endpoint. The vulnerability is triggered when the global showURL configuration setting is enabled, causing the application to improperly serialize and return complete monitor objects, including sensitive authorization secrets intended for internal HTTP provider usage. Unauthorized external visitors can exploit this flaw by issuing a GET request to the unauthenticated endpoint to harvest plain-text credentials. The harvested secrets can subsequently be leveraged to impersonate or compromise monitored services and downstream infrastructure. Exploitation requires no prior authentication or administrative privileges, relying solely on network accessibility to the status page API and the misconfiguration or activation of the global showURL setting. Risk implications include unauthorized credential exposure, potential pivot attacks against monitored infrastructure, and complete confidentiality breaches of affected monitor configurations. The issue is fully resolved in version 3.9.2, which restricts the exposure of sensitive fields within the API response.",
  "technicalDetails": "The vulnerability resides within the backend routing and controller logic of Checkmate, specifically in server/src/controllers/statusPageController.ts, where the GET /api/v1/status-page/:url endpoint processes requests for public status pages. The root cause of the flaw is the overly permissive serialization of monitor objects when the global showURL setting is active, returning the full database object representation rather than a sanitized subset of data suitable for public consumption. This includes the internal secret field utilized by HttpProvider.ts to construct HTTP Authorization credentials for polling target services. Although the frontend component BaseStatusPage.tsx does not explicitly render or display this secret in the Document Object Model or user interface, the underlying JSON payload transmitted over the network contains the unmasked credentials. The attack flow proceeds as follows: an unauthenticated network adversary identifies a Checkmate instance where the global showURL configuration is enabled. The attacker then issues an unauthenticated HTTP GET request directly to the vulnerable endpoint /api/v1/status-page/:url. The statusPageController retrieves the complete monitor object from the persistence layer and serializes it into the JSON response without filtering out sensitive authentication parameters. Upon receiving the response, the attacker parses the JSON payload, extracts the secret field tied to the HttpProvider.ts execution context, and obtains valid HTTP Authorization credentials. Post-exploitation impact encompasses the reuse of these extracted credentials against the monitored services, potentially granting the attacker unauthorized access, data exfiltration capabilities, or administrative control over the underlying infrastructure being monitored by Checkmate. The affected component is the status page controller processing unauthenticated API requests across Checkmate versions 3.3.0 up to 3.9.2, with no authentication or privilege requirements necessary to execute the attack vectors over the network."
}