---
id: "CVE-2026-113461"
kind: "vulnerability"
aliases: ["CVE-2026-113461"]
title: "Checkmk: local user with write access escalates to root via Oracle plugin"
severity: "medium"
cvss: 5.2
epss: 0.00092
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["checkmk", "infrastructure", "linux", "oracle", "self-hosted"]
not_affected_if: ["mk-oracle-plugin-disabled", "no-oracle-home-in-oratab", "no-untrusted-local-users"]
published_at: "2026-10-21T19:16:59+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:28:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113461", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-113461", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Checkmk: local user with write access escalates to root via Oracle plugin

Checkmk 2.5.0p14 has a local privilege escalation in its mk-oracle agent plugin. A local user who can write to the Oracle client library directory or the oratab file can run code as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `omd version` or the Checkmk package version, to see whether it is `2.5.0p14`
- Check whether the mk-oracle plugin is enabled on the host and whether the oratab file and Oracle client library directories are writable by non-root users
- unknown for other checks

## Fix

- Upgrade Checkmk past `2.5.0p14` to a release that carries the fix (the exact fixed version is unknown from the sources)
- Restrict write access on the oratab file and the Oracle client library directories to root
- Disable the mk-oracle plugin if it is not needed

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113461
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-113461

## From the sources

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_