CVE-2026-30829: 
NixOS vulnerability analysis and mitigation

CVE-2026-30829 is an unauthenticated information disclosure vulnerability in Checkmate, an open-source self-hosted server monitoring and uptime tracking tool by Bluewave Labs. The vulnerability exists in the GET /api/v1/status-page/:url endpoint, which fails to enforce authentication or validate whether a status page is published before returning its full details. All versions prior to 3.4.0 are affected. It was published on March 7, 2026, and patched in version 3.4.0. The CVSS v3.1 base score is 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerable route in server/src/routes/statusPageRoute.ts registers the handler this.router.get("/:url", this.statusPageController.getStatusPageByUrl) without applying the verifyJWT middleware, meaning no authentication is enforced. The getStatusPageByUrl controller method also lacks any check on the isPublished flag, so it returns full status page data — including internal monitoring configuration — regardless of whether the page is intended to be public. Exploitation requires only a direct HTTP GET request to the endpoint with a known or guessed status page URL slug, with no credentials or special conditions needed (GitHub Advisory).

Successful exploitation allows any unauthenticated network attacker to retrieve the full contents of unpublished (private) status pages, including internal monitoring data, server configurations, and incident details that were intended to remain private. While there is no integrity or availability impact, the confidentiality exposure could reveal sensitive infrastructure details such as monitored hostnames, service endpoints, and operational status that could aid further reconnaissance or targeted attacks (GitHub Advisory, Feedly).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a simple curl command requiring no authentication. As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.035%, reflecting a low probability of near-term exploitation (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible Checkmate instances running versions prior to 3.4.0. Instances are typically self-hosted and may be discoverable via Shodan or Censys by searching for the Checkmate application banner or default port.
2. Enumerate status page URLs: Attempt to guess or enumerate status page URL slugs (e.g., from public-facing links, leaked references, or common naming conventions used by the organization).
3. Send unauthenticated API request: Issue a direct HTTP GET request to the vulnerable endpoint without any authentication headers:

   curl http://<target-host>:<port>/api/v1/status-page/<status-page-address>?type=uptime

4. Retrieve sensitive data: The server responds with the full status page JSON payload, including unpublished page details, associated monitor configurations, and internal infrastructure data, without requiring any credentials (GitHub Advisory).

• Network: Unexpected or repeated HTTP GET requests to /api/v1/status-page/<slug>?type=uptime from external or unknown IP addresses, particularly without any prior authentication attempts.
• Logs: Web server or application access logs showing unauthenticated requests to the /api/v1/status-page/ endpoint returning HTTP 200 responses with full JSON payloads; requests originating from automated tools (e.g., curl, python-requests user agents).
• Behavioral: High volume of requests to the status page API endpoint from a single IP, suggesting enumeration of status page slugs (GitHub Advisory).

Upgrade Checkmate to version 3.4.0 or later, which patches the vulnerability by enforcing authentication and validating the isPublished flag on the affected endpoint. As an interim workaround, implement network-level access controls (e.g., firewall rules or reverse proxy authentication) to restrict direct external access to the /api/v1/status-page/ API endpoint until patching is feasible. Reporters credited for discovery are theamanrawat and neo-ai-engineer (GitHub Advisory).

A security-focused blog post titled "Checkmate Open-Source Uptime Monitoring Under Fire: New Zero-Day Exposes Secret Status Pages" was published on undercodetesting.com, indicating some community attention to the vulnerability. No major vendor statements beyond the official GitHub Security Advisory have been identified, and broader media coverage appears limited given the moderate severity and niche scope of the affected software (Feedly).