CVE-2026-105331 Details
Description
Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.
A local privilege escalation vulnerability exists in Checkmk versions 2.5.0 prior to 2.5.0p10. This issue allows a user with permission to edit the Oracle Instant Client used by the 'mk-oracle' agent plugin to escalate privileges. The vulnerability arises because the 'mk-oracle' plugin did not properly validate the permissions of user-modifiable resources, such as shared libraries and SQL query files, in the Oracle Instant Client. As a result, a lower-privileged user could manipulate these files to gain elevated rights.
Users can update to Checkmk version 2.5.0p10 or later, where this vulnerability has been addressed. After updating, the 'mk-oracle' plugin will validate the permissions of user-shared libraries, DLLs, and SQL query files, rejecting unsafe files to prevent privilege escalation. On Windows, trusted entities can be configured via safe lists in the Setup GUI.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://checkmk.com/werk/22619 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-426 | Untrusted Search Path | [email protected] |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Checkmk | 2.5.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |