Werk #19231: Fix privilege escalation via unprotected Windows agent data folder
| Component | Checks & agents | ||||||||
| Title | Fix privilege escalation via unprotected Windows agent data folder | ||||||||
| Date | Oct 19, 2026 | ||||||||
| Level | Prominent Change | ||||||||
| Class | Security Fix | ||||||||
| Compatibility | Compatible - no manual interaction needed | ||||||||
| Checkmk versions & editions |
|
Prior to this Werk, the Checkmk Windows Agent could leave the permissions of
C:\ProgramData\checkmk and everything below it unchanged after a fresh
installation. Members of the local Users group kept the write and read
access inherited from C:\ProgramData.
An authenticated user on the monitored host could then place a script in
agent\local or agent\plugins, which the agent service runs as
LocalSystem, and read registered_connections.json. This is the same
condition that Werk #16845 and Werk #17098 describe as fixed.
The agent applies these permissions by running icacls commands from a
script in its temporary folder. The script was started asynchronously, and
the agent clears that folder again later during service startup. Whenever
the script was removed before cmd.exe had worked through it, the remaining
permission changes were silently lost. The agent logged the intended changes
in either case, so the agent log showed no error.
The agent now waits for the permission script to finish before it continues its startup.
Note that you must update the agent on the monitored hosts in order to apply this fix. Updating the Checkmk site alone is not sufficient.
Affected Versions:
- 2.5.0
- 2.4.0
- 2.3.0
- 2.2.0 (eol)
From 2.5.0p9 on, the permissions were lost on every service start. In the older versions the outcome depends on timing, and the permissions were usually applied.
Mitigations:
If updating the agent is not possible, you can apply the permissions by hand.
Disable inheritance on C:\ProgramData\checkmk and remove the entries for
the local Users group, then check with
Get-Acl C:\ProgramData\checkmk\agent\local that no entry grants write
access to normal users.
Vulnerability Management:
We have rated the issue with a CVSS score of 6.3 (Medium) with the following
CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H,
and assigned CVE-2026-111573.
This issue was reported to us externally via our security mailbox by Michal 'mdronski.pl' Dronski
and one other anonymous reporter.