CVE-2026-113461

mk-oracle: Local privilege escalation via insecure Oracle Home library loading

State: Published
Severity: 5.2 Medium
Published: Oct 21, 2026
Updated: Oct 23, 2026
Reserved: Oct 20, 2026

Description

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.

Scores

CVSS	Score	Vector	Source
4.0	5.2 Medium	CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H	Checkmk

Weaknesses

CWE-426 Untrusted Search Path
CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Affected Products

Product	Versions
CheckmkCheckmk GmbH	2.5.0p14Affected

References

https://checkmk.com/werk/22621vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.