{"id":"CVE-2026-113461","kind":"vulnerability","aliases":["CVE-2026-113461"],"related":[],"title":"Checkmk: local user with write access escalates to root via Oracle plugin","description":"Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.","summary":"Checkmk 2.5.0p14 has a local privilege escalation in its mk-oracle agent plugin. A local user who can write to the Oracle client library directory or the oratab file can run code as root.","severity":"medium","cvss":5.2,"epss":0.00092,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["checkmk","infrastructure","linux","oracle","self-hosted"],"not_affected_if":["mk-oracle-plugin-disabled","no-oracle-home-in-oratab","no-untrusted-local-users"],"how_to_check":"- `omd version` or the Checkmk package version, to see whether it is `2.5.0p14`\n- Check whether the mk-oracle plugin is enabled on the host and whether the oratab file and Oracle client library directories are writable by non-root users\n- unknown for other checks","fix":"- Upgrade Checkmk past `2.5.0p14` to a release that carries the fix (the exact fixed version is unknown from the sources)\n- Restrict write access on the oratab file and the Oracle client library directories to root\n- Disable the mk-oracle plugin if it is not needed","status":"open","published_at":"2026-10-21T19:16:59+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:28:47+00:00","updated_at":"2026-10-25T04:28:47+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T04:28:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Checkmk past `2.5.0p14` to a release that carries the fix (the exact fixed version is unknown from the sources)\n- Restrict write access on the oratab file and the Oracle client library directories to root\n- Disable the mk-oracle plugin if it is not needed","reach":"local","title":"Checkmk: local user with write access escalates to root via Oracle plugin","impact":"high","summary":"Checkmk 2.5.0p14 has a local privilege escalation in its mk-oracle agent plugin. A local user who can write to the Oracle client library directory or the oratab file can run code as root.","category":"infrastructure","nicknames":[],"who_cares":["checkmk","oracle","linux","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Local user gains root code execution on the monitored host.","analyst_note":"Find the fixed Checkmk version and the exact file permissions the advisory expects, from the NVD entry or the Checkmk security advisory.","how_to_check":"- `omd version` or the Checkmk package version, to see whether it is `2.5.0p14`\n- Check whether the mk-oracle plugin is enabled on the host and whether the oratab file and Oracle client library directories are writable by non-root users\n- unknown for other checks","needs_analyst":true,"not_affected_if":["mk-oracle-plugin-disabled","no-oracle-home-in-oratab","no-untrusted-local-users"],"who_is_affected":"Hosts running the Checkmk agent with the mk-oracle plugin enabled on Checkmk 2.5.0p14, where an Oracle home is listed in oratab. The attacker must already have a local account with write access to the Oracle client library directory or to oratab. Hosts without the mk-oracle plugin or without Oracle homes in oratab can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":3359,"output_tokens":674,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113461':15A,18A '-2026':14A,17A '2.5.0':27B,67C 'access':6A,75C 'agent':39B,104C 'allow':69C 'checkmk':1A,19B,26B,66C 'client':50B,79C 'code':59B,99C 'cve':13A,16A 'directori':52B,81C 'enabl':111C 'escal':7A,33B,64C 'execut':98C 'file':56B,90C,95C 'home':85C 'host':25B 'infrastructur':20B 'librari':51B,80C 'linux':21B 'list':86C 'local':2A,31B,42B,62C,71C 'mk':37B,108C 'mk-oracl':36B,107C 'oracl':11A,22B,38B,49B,78C,84C,109C 'oratab':55B,89C,94C 'p14':28B,68C 'plugin':12A,40B,110C 'privileg':32B,63C 'root':9A,61B,101C 'run':58B 'self':24B 'self-host':23B 'user':3A,43B,72C 'via':10A 'write':5A,46B,74C","nicknames":[],"mitigations":[],"who_affected":"Hosts running the Checkmk agent with the mk-oracle plugin enabled on Checkmk 2.5.0p14, where an Oracle home is listed in oratab. The attacker must already have a local account with write access to the Oracle client library directory or to oratab. Hosts without the mk-oracle plugin or without Oracle homes in oratab can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T19:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@checkmk.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113461","severity":null,"published_at":"2026-10-21T19:16:59+00:00","modified_at":"2026-10-23T12:18:11+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113461","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113461","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}