Werk #22621: Fix permission check in mk-oracle when loading Oracle home instances
| Component | Checks & agents | ||
| Title | Fix permission check in mk-oracle when loading Oracle home instances | ||
| Date | Oct 21, 2026 | ||
| Level | Trivial Change | ||
| Class | Security Fix | ||
| Compatibility | Compatible - no manual interaction needed | ||
| Checkmk versions & editions |
|
In Checkmk 2.5.0p14 mk-oracle introduced loading individual Oracle home libraries for instances created from Oracle homes listed in the oratab. This implementation did not properly validate the permissions of individual Oracle home libraries, which could allow a user with write access to one of these libraries or to the oratab file itself to escalate their privileges. As of Checkmk 2.5.0p15, libraries are either loaded as the user who owns the files or rejected, preventing privilege escalation through unsafe Oracle home directory loading.
The permissions_check option must be set to yes in the mk-oracle configuration YAML for these validations to be enabled.
Who is Affected
Systems running the agent with the mk-oracle plugin enabled. The attack requires write access to the Oracle home libraries of instances listed in the oratab.
Affected Checkmk Versions
- 2.5.0p14
Vulnerability Management
We have rated the issue with a CVSS Score of 5.2 Medium(CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H) and assigned CVE-2026-113461.
This issue was found by internal review.
Indicators of Compromise
We advise users to validate the write access and file integrity of individual Oracle Home libraries listed in agent's host's oratab and the oratab file itself.