CVE-2026-105331: Checkmk Privilege Escalation Vulnerability

CVE-2026-105331 Overview

CVE-2026-105331 is a local privilege escalation vulnerability in Checkmk 2.5.0 before 2.5.0p10. The flaw resides in how the mk-oracle agent plugin references the Oracle Instant Client. A user with permission to edit the referenced Oracle Instant Client can replace trusted components and gain elevated privileges when an agent runs the plugin. The weakness is classified as [CWE-426] Untrusted Search Path. Exploitation requires local access and the plugin must be enabled on the target agent.

Critical Impact
A low-privileged local user who can modify files loaded by mk-oracle can execute code in the context of the Checkmk agent, compromising confidentiality, integrity, and availability of the monitored host.

Affected Products

Checkmk 2.5.0 (all releases prior to 2.5.0p10)
Checkmk agent deployments with the mk-oracle plugin enabled
Hosts where the referenced Oracle Instant Client path is writable by non-privileged users

Discovery Timeline

2026-10-08 - CVE-2026-105331 published to NVD
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-105331

Vulnerability Analysis

The mk-oracle agent plugin shipped with Checkmk invokes functionality supplied by the Oracle Instant Client. The plugin resolves the client via a path that is not sufficiently restricted. When the plugin runs under the Checkmk agent's privilege context, any library or binary loaded from that path executes with the same privileges. A local user with write access to the referenced client directory can plant a malicious binary or shared object. Each subsequent agent poll triggers execution. The scope changes from the attacker's low-privileged account to the agent account, which typically has broader system access. This matches the [CWE-426] Untrusted Search Path pattern.

Root Cause

The root cause is reliance on a filesystem location for the Oracle Instant Client that is not validated for integrity or ownership before the plugin loads it. The plugin trusts the referenced path at execution time without ensuring the resources originate from an administrator-controlled source.

Attack Vector

Exploitation requires a local account on the monitored host plus write access to the Oracle Instant Client location consumed by mk-oracle. The attacker places a crafted library or executable in that location. When the Checkmk agent next invokes the plugin, the planted code runs with the agent's privileges. No network access, user interaction, or authentication to Checkmk itself is required.

No verified public exploit code is available. Technical details are documented in the Checkmk Werk 22619 advisory.

Detection Methods for CVE-2026-105331

Indicators of Compromise

Unexpected shared objects or executables appearing within the Oracle Instant Client directory referenced by mk-oracle
Modified file ownership or permissions on Oracle Instant Client components previously controlled by administrators
Checkmk agent processes spawning unexpected child processes or network connections after plugin execution
Audit log entries showing non-administrative accounts writing to directories consumed by agent plugins

Detection Strategies

Inventory the filesystem path referenced by mk-oracle on every host where the plugin is enabled, and verify ACLs restrict writes to privileged accounts
Baseline the Checkmk agent and plugin binaries, then alert on any hash change for files in the Oracle Instant Client directory
Correlate process executions originating from the Checkmk agent with the user context of files it loads

Monitoring Recommendations

Enable filesystem integrity monitoring (FIM) on the Oracle Instant Client directory and mk-oracle plugin location
Log and review all file write events to agent plugin and dependency directories using host auditing (auditd, Sysmon)
Monitor for Checkmk agent child processes executing from user-writable paths

How to Mitigate CVE-2026-105331

Immediate Actions Required

Upgrade Checkmk 2.5.0 installations to version 2.5.0p10 or later
Audit every host where the mk-oracle plugin is enabled and confirm the Oracle Instant Client path is owned by root or an equivalent administrative account
Remove write permissions on the Oracle Instant Client directory for all non-privileged users
Review recent file modifications in the referenced directory for unauthorized changes

Patch Information

Checkmk resolved the issue in release 2.5.0p10. The fix is documented in the Checkmk Werk 22619 advisory. Administrators running any 2.5.0 build prior to p10 with mk-oracle deployed should prioritize the upgrade.

Workarounds

Disable the mk-oracle plugin on agents where Oracle monitoring is not required until the upgrade is applied
Relocate the Oracle Instant Client to a directory writable only by root and update the plugin configuration accordingly
Apply mandatory access controls (SELinux, AppArmor) to restrict which accounts can modify files loaded by the Checkmk agent

bash

# Verify installed Checkmk agent version and plugin presence
cmk-agent-ctl status
ls -l /usr/lib/check_mk_agent/plugins/mk-oracle

# Harden the Oracle Instant Client directory (adjust path to your environment)
chown -R root:root /opt/oracle/instantclient
chmod -R go-w /opt/oracle/instantclient