Vulnerability Description
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url endpoint. The endpoint does not enforce authentication or verify whether a status page is published before returning full status page details. As a result, unpublished status pages and their associated internal data are accessible to any unauthenticated user via direct API requests. This issue has been patched in version 3.4.0.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bluewavelabs | Checkmate | < 3.4.0 |
Related Weaknesses (CWE)
References
- https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-57xf-wg6w-fjExploitVendor Advisory
FAQ
What is CVE-2026-30829?
CVE-2026-30829 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, a...
How severe is CVE-2026-30829?
CVE-2026-30829 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-30829?
Check the references section above for vendor advisories and patch information. Affected products include: Bluewavelabs Checkmate.