TI-2026-78954 Aliases CVE-2026-113461 GHSA-2pwc-pprg-4jmv

Local privilege escalation in Checkmk mk-oracle plugin

LOW 24CWE-426Published 2026-10-21 · Updated 2026-10-23

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Attack requirements: Present
Impact type: Code execution
Confidentiality · integrity · availability: None · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-426.

Summary

Checkmk 2.5.0p14 has a flaw where the mk-oracle plugin loads Oracle client libraries from an untrusted search path (CWE-426). A local user with write access to the Oracle client library directory of an Oracle home listed in the oratab file, or to the oratab file itself, can execute code as root when the agent has the mk-oracle plugin enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0012 1st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Checkmk GmbH	Checkmk	2.5.0p14	—	No fix listed	CNA

Checkmk VendorCheckmk GmbH Affected 2.5.0p14 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:checkmk:checkmk::::::::	—	—	Checkmk GmbH

cpe:2.3:a:checkmk:checkmk:*:*:*:*:*:*:*:* Versions — — ·Checkmk GmbH

Remediation

The sources list no fixed version for Checkmk.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-21 Threatist record created from CVE-2026-113461
2026-10-21 Alias added: GHSA-2pwc-pprg-4jmv
2026-10-23 CISA SSVC decision points changed
2026-10-23 CISA SSVC decision points changed

References

Advisory 1

https://checkmk.com/werk/22621

TI-2025-26345 Cross Site Scripting through compromised remote site CVSS 4.0HIGH 8.5
TI-2025-40190 Cross-site scripting in HTML logs of Synthetic Monitoring test services CVSS 4.0HIGH 7.3
TI-2024-12762 Checkmk NagVis Remote Code Execution CVSS 3.1HIGH 7.2
TI-2024-12761 Checkmk NagVis Reflected Cross-site Scripting CVSS 3.1MEDIUM 5.4
TI-2024-19037 Brute-force protection ineffective for some login methods CVSS 3.1CRITICAL 9.8
TI-2024-05712 local IP restriction of internal HTTP endpoints CVSS 3.1CRITICAL 9.8

See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences