CVE-2026-113461: mk-oracle: Local privilege escalation via insecure Oracle Home library loading
Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to exploitation?
Systems are exposed when the Checkmk agent has the mk-oracle plugin enabled and an Oracle home listed in oratab is involved. Exploitation also requires a local user to have write access to that Oracle home's client library directory or to the oratab file itself.
What level of access does an attacker need?
The attacker needs local access and the ability to modify either the Oracle client library directory for an Oracle home referenced by oratab, or the oratab file itself. The issue can then allow code execution as root.
Is an agent with mk-oracle enabled affected by default?
Not solely from having mk-oracle enabled. The additional required condition is write access for a local user to the relevant Oracle client library directory or to oratab.