TI-2026-69519 Aliases CVE-2026-105331 GHSA-hmv5-8m9q-xc8h

Local privilege escalation in Checkmk via Oracle Instant Client

LOW 24CWE-426Published 2026-10-08 · Updated 2026-10-09

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-426.

Summary

Checkmk from 2.5.0 before 2.5.0p10 is affected. A local privilege escalation flaw, classified as CWE-426 (untrusted search path), lets a user who can edit the Oracle Instant Client used by the mk-oracle agent plugin gain higher privileges. The escalation happens when an agent runs with this plugin enabled. Exploitation requires local access with low privileges and a high-complexity attack.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00084 0th percentileScored 2026-11-07

Fix Fixed Checkmk (Checkmk GmbH): 2.5.0p10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Checkmk GmbH	Checkmk	2.5.0 to before 2.5.0p10	2.5.0p10	Patch available	CNA

Checkmk VendorCheckmk GmbH Affected 2.5.0 to before 2.5.0p10 Fixed in 2.5.0p10 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:checkmk:checkmk::::::::	—	—	Checkmk GmbH

cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:* Versions — — ·Checkmk GmbH

Remediation

Update Checkmk to 2.5.0p10, which fixes this issue. No vendor advisory identifier is listed in the sources.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA Checkmk (Checkmk GmbH) Fixed in 2.5.0p10

Timeline

2026-10-08 Threatist record created from CVE-2026-105331
2026-10-08 Alias added: GHSA-hmv5-8m9q-xc8h
2026-10-09 CISA SSVC decision points changed

References

Advisory 1

https://checkmk.com/werk/22619

TI-2025-26345 Cross Site Scripting through compromised remote site CVSS 4.0HIGH 8.5
TI-2025-40190 Cross-site scripting in HTML logs of Synthetic Monitoring test services CVSS 4.0HIGH 7.3
TI-2024-12762 Checkmk NagVis Remote Code Execution CVSS 3.1HIGH 7.2
TI-2024-12761 Checkmk NagVis Reflected Cross-site Scripting CVSS 3.1MEDIUM 5.4
TI-2024-19037 Brute-force protection ineffective for some login methods CVSS 3.1CRITICAL 9.8
TI-2024-05712 local IP restriction of internal HTTP endpoints CVSS 3.1CRITICAL 9.8

See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences