Description
Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.
Published: 2026-10-21
Score: 5.2 Medium
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://checkmk.com/werk/22621 cve-icon cve-icon
History

Wed, 21 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.
Title mk-oracle: Local privilege escalation via insecure Oracle Home library loading
First Time appeared Checkmk
Checkmk checkmk
Weaknesses CWE-426
CWE-829
CPEs cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:*
Vendors & Products Checkmk
Checkmk checkmk
References
Metrics cvssV4_0

{'score': 5.2, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H'}

Subscriptions

Checkmk Checkmk
cve-icon MITRE

Status: PUBLISHED

Assigner: Checkmk

Published:

Updated: 2026-10-21T18:11:34.774Z

Reserved: 2026-10-20T07:46:46.328Z

Link: CVE-2026-113461

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-21T19:16:59.903

Modified: 2026-10-21T19:17:00.057

Link: CVE-2026-113461

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-426

    Untrusted Search Path

  • CWE-829

    Inclusion of Functionality from Untrusted Control Sphere