CVE-2021-40905 is a disputed report concerning Checkmk extension packages (MKPs) in commercial editions [S1][S2]. The current CVE record says exploitation requires valid administrator access or a hijacked administrator session and records the vendor position that administrators are intentionally able to execute code through this mechanism [S1].
What MKPs are
Checkmk documents MKPs as its package format for extensions written with Python and other plug-in components [S2]. In commercial editions, administrators can upload a package through the Setup interface and then separately activate it. Activation installs the extension files into the Checkmk site and makes their functions available [S2].
That is a powerful administrative capability and creates a software-supply-chain trust boundary, but the documented ability of an administrator to install executable extensions is not by itself proof of a product vulnerability.
Evidence boundary
The CVE record associates the report with Checkmk Enterprise Edition versions 1.5.0 through 2.0.0p9, but labels the report disputed and does not cite a vendor-confirmed fixed release [S1]. Checkmk's current documentation continues to describe MKP upload and activation as supported administrative operations [S2].
A public product or version string can identify a Checkmk deployment. It cannot show whether an untrusted user can access Extension packages, whether an administrator session has been hijacked, whether an untrusted MKP was uploaded or activated, or whether account and network controls are inadequate.
Why FixVibe will not check this automatically
A passive version match would turn a disputed, administrator-intended capability into a high-severity finding without evidence of privilege misuse or untrusted package execution. That would overstate what the scan verified. Confirming more would require authenticating to the management console, inspecting administrative package state, or uploading and activating an extension. FixVibe does not perform those privileged or state-changing actions.
This article therefore remains a research note rather than a live FixVibe scanner check.
Secure operation
Checkmk operators should:
- Run a currently supported Checkmk release and follow vendor release and security guidance.
- Restrict the Setup interface to trusted management networks or a VPN.
- Minimize administrator accounts, use strong authentication and SSO or multi-factor controls where available, and protect administrator sessions.
- Install MKPs only from trusted, reviewed sources and test third-party packages on a non-production site before activation, as Checkmk recommends [S2].
- Inventory enabled MKPs and review administrator and configuration-change activity for unexpected uploads or activations.
- If an untrusted package may have been activated, disable and remove it, inspect the Checkmk site's local extension files, rotate affected administrator credentials and sessions, and investigate the host for unauthorized changes.
The CVE record does not establish that version 2.0.0p10 is a vendor-confirmed fix for this disputed behavior, so remediation should not rely on that version boundary alone.