---
id: CVE-2026-105331
title: >-
  Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with
  access to edit the Oracle Instant Client referenced by the agent plugin
  'mk-oracle' to escalate their privileges if an agent has this plugin enabled.
summary: >-
  Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with
  access to edit the Oracle Instant Client referenced by the agent plugin
  'mk-oracle' to escalate their privileges if an agent has this plugin enabled.
severity: medium
cvss: 5.2
cvssVector: 'CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H'
cwe:
  - CWE-426
  - CWE-829
vendor: Checkmk GmbH
product: Checkmk
affected:
  - Checkmk >= 2.5.0 < 2.5.0p10
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:01.383'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105331'
references:
  - url: 'https://checkmk.com/werk/22619'
    label: security@checkmk.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T15:22:03.242891Z'
cvssSource: cna
ingestedAt: '2026-10-08T14:47:16.351Z'
---

## Overview

Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.