---
id: CVE-2026-113461
title: 'mk-oracle: Local privilege escalation via insecure Oracle Home library loading'
summary: >-
  Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write
  access to the Oracle client library directory of an Oracle home listed in the
  'oratab' file or to the 'oratab' file itself to execute code as root if an
  agent …
severity: medium
cvss: 5.2
cvssVector: 'CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-426
  - CWE-829
vendor: Checkmk GmbH
product: Checkmk
affected:
  - Checkmk 2.5.0p14
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T18:11:34.774Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113461'
references:
  - url: 'https://checkmk.com/werk/22621'
tags:
  - cve.org
ingestedAt: '2026-10-21T19:10:31.408Z'
---

## Overview

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.

## Affected

- `Checkmk 2.5.0p14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.