CVE-2026-105331: mk-oracle: Local privilege escalation via malicious Oracle Instant Client
Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Checkmkto a version that resolves this vulnerability.Fixed in 2.5.0p10
Event History
Frequently Asked Questions
Which deployments are affected?
Checkmk 2.5.0 installations before 2.5.0p10 are affected when the agent has the mk-oracle plugin enabled and references an Oracle Instant Client that a local user can edit.
What access does an attacker need?
The attacker needs local access and the ability to modify the Oracle Instant Client used by the mk-oracle agent plugin. Exploitation also depends on an agent with that plugin enabled.
What version addresses the issue?
The issue affects Checkmk 2.5.0 releases before 2.5.0p10. Updating to 2.5.0p10 or later within the stated release line addresses the affected version range.
What can be done before updating?
Ensure unprivileged users cannot modify the Oracle Instant Client referenced by mk-oracle. Systems that do not have the mk-oracle plugin enabled do not meet the stated exploitation condition.