CVE-2026-105331 in Checkmk
Summary
by MITRE • 10/08/2026
Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified as CVE-2024-39687 represents a critical local privilege escalation flaw within Checkmk versions prior to 2.5.0p10, specifically affecting the Oracle Instant Client integration mechanism used by the mk-oracle agent plugin. This security issue arises from an insufficient validation of file paths and permissions associated with external libraries referenced in configuration files managed by users who possess edit privileges for specific monitoring plugins. When a user is granted permission to modify the settings or scripts related to the mk-oracle plugin, they can manipulate the path pointing to the Oracle Instant Client shared library binaries. Because Checkmk agents often execute with elevated system privileges to gather comprehensive host metrics and status information, any command execution or dynamic linking operation performed by these agents inherits those high-level permissions. Consequently, an attacker who has compromised a standard user account with write access to this specific plugin configuration can redirect the agent to load a maliciously crafted shared library instead of the legitimate Oracle Instant Client binary.
From a technical perspective, this flaw is rooted in improper control over resource paths, which aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-94: Improper Control of Generation of Code (Code Injection). The vulnerability exploits the trust relationship between the monitoring agent's execution context and its configuration files. When the Checkmk agent initializes or processes data for an Oracle database host, it dynamically loads the specified Instant Client libraries. If the path is not strictly validated against a whitelist of allowed directories or if file permissions do not prevent unauthorized modification by lower-privileged users, the operating system will load whatever library resides at that location during runtime. This allows the attacker to inject arbitrary code into the agent's process space. The attack vector requires local access and specific configuration write privileges, making it an insider threat scenario or a post-exploitation escalation path for attackers who have already gained foothold on a monitored host through other means such as phishing or unpatched web application vulnerabilities.
The operational impact of this vulnerability is severe due to the nature of monitoring agents in enterprise environments. These agents typically run with root privileges on Linux systems or SYSTEM-level access on Windows hosts to ensure they can collect all necessary performance data, including disk I/O, network statistics, and process states. By exploiting this privilege escalation vector, an attacker gains full control over the underlying operating system. This grants unrestricted read and write access to sensitive files, the ability to install persistent backdoors, pivot into other parts of the internal network via compromised credentials stored on the host, or disrupt critical monitoring infrastructure by tampering with Checkmk data integrity. The attack is particularly dangerous because it bypasses traditional perimeter defenses and relies on legitimate administrative tools being misconfigured or abused, making detection difficult without strict file integrity monitoring and least-privilege enforcement policies.
To mitigate this vulnerability, organizations must immediately upgrade to Checkmk version 2.5.0p10 or later, where the developers have implemented stricter validation for plugin configurations and restricted write access to critical configuration files associated with agent plugins like mk-oracle. In addition to patching, administrators should enforce strict file system permissions on all directories containing monitoring scripts and library references, ensuring that only privileged service accounts can modify these paths rather than general user groups. Implementing mandatory access control systems such as SELinux or AppArmor can further restrict the ability of unprivileged users to alter configuration files used by high-privilege processes. Furthermore, adopting a principle of least privilege for all monitoring agent configurations and regularly auditing file permissions against industry standards like CIS Benchmarks will reduce the attack surface. Security teams should also monitor for unusual library loading events or unexpected changes in plugin configurations using endpoint detection and response solutions that align with MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter abuse and T1203 File Execution, ensuring rapid detection of any attempted exploitation attempts before privilege escalation is successfully achieved.