CVE-2026-105331

Executive Summary

CVE-2026-105331 is a local privilege escalation vulnerability in Checkmk 2.5.0 before 2.5.0p10. It affects deployments where the monitoring agent has the mk-oracle plugin enabled and a low-privileged user can edit the Oracle Instant Client path or its contents referenced by that plugin. Successful exploitation enables a local user to execute code or influence privileged processes in the agent's context, escalating privileges on the monitored host.

Technical Analysis

The vulnerability is classified as CWE-426 (Untrusted Search Path). The Checkmk mk-oracle agent plugin relies on an external Oracle Instant Client. According to the NVD description, a user who can edit the Oracle Instant Client that the plugin references may escalate privileges when the agent runs the plugin.

Mechanism (class-level): This is an untrusted search path / unsafe dependency resolution issue. When a privileged process (the Checkmk agent) loads or executes components from a location that an unprivileged user can modify or redirect, the user can cause the privileged process to load attacker-controlled binaries or libraries. In this case, the "search path" is effectively the Oracle Instant Client installation referenced by mk-oracle.

Attack surface:

• Local, host-level: the monitoring agent (Checkmk agent) executing mk-oracle.
• Requires the plugin to be enabled on that agent.
• Requires attacker ability to edit the Oracle Instant Client referenced by the plugin (typically via filesystem write or path redirection).

Security impact: local privilege escalation. An attacker with limited local access could obtain elevated privileges in the agent's execution context (potentially root, depending on how the agent is run). No specific function/class names are provided in the CVE description; therefore no code-level identifiers are asserted.

Exploitation Scenarios

The NVD description supports a clear attack chain at the class level; no public PoC or exploit code (POC_STATUS: None; Nuclei: NO).

1. Reconnaissance / Target Identification

• Identify hosts running Checkmk agent 2.5.0 with mk-oracle enabled. Evidence may be visible via plugin invocations, agent configuration, or from monitoring data. This is host-local reconnaissance (valid because the advisory is a local privilege escalation).

2. Triggering the Flaw Class (Untrusted Search Path)

• Determine where the Oracle Instant Client referenced by mk-oracle is located and whether the current user can edit it (files or directory). The flaw is triggered when the privileged agent process subsequently uses the client from a user-influenceable location without integrity validation.

3. Payload / Execution (class-level)

• Replace or modify the referenced Oracle Instant Client component (e.g., executable or library) with attacker-controlled content such that when the agent executes/loads it, attacker code runs. The exact loading pattern is not described in the CVE text, so no specific filenames, symbols, or environment variables are assumed.

4. Post-Exploitation Impact

• Privilege escalation to the agent's effective privileges. This enables actions governed by those privileges, including modifying monitoring configuration/scripts, tampering with other plugins/services, and using the agent context for deeper local compromise. There is no stated evidence of remote execution or lateral movement in the CVE description.

No detection-in-the-wild data, no exploit kit data, and no KEV listing were provided; exploitation is inferred by vulnerability class (CWE-426) rather than observed.

Impact Assessment

• Severity: local privilege escalation. CVSS scoring is not assigned (N/A) by the feed provided. The provided vector string reflects high confidentiality/integrity/availability impact locally (C:H/I:H/A:H), with high attack complexity (AC:H) and low privileges requirement (PR:L).
• Affected systems: Checkmk 2.5.0 before 2.5.0p10 deployments where an agent has mk-oracle enabled and the Oracle Instant Client referenced by that plugin is user-editable.
• Blast radius: per-host escalation; risk scales with the agent's privileges. If the agent runs as root, full host compromise is possible. Environments with tightly controlled filesystem permissions reduce exposure.

Detection Guidance

Detection is challenging because the activity is local and may resemble legitimate agent operation. Focus on process lineage, file integrity changes, and suspicious access to agent plugin paths. The following rules are intended to be adjusted to your environment's naming.

Sigma Rule

title: Possible Checkmk mk-oracle Untrusted Oracle Instant Client Privilege Escalation (CVE-2026-105331)
id: 4f7f0d3c-8a6e-4c9a-9d3a-1a6d2b0f9c41
status: experimental
description: Detects suspicious execution of Checkmk agent plugin mk-oracle or related Oracle Instant Client binaries from user-writable locations, which may indicate exploitation of CVE-2026-105331.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105331
author: valtersit.com
date: 2026/01/28
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.105331
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/check_mk_agent'
      - '/cmk-agent-ctl'
      - '/check-mk-agent'
  selection_plugin_or_client:
    Image|endswith:
      - '/mk-oracle'
    CommandLine|contains:
      - 'mk-oracle'
      - 'oracle'
      - 'instantclient'
  selection_userwritable_paths:
    Image|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/home/'
  condition: selection_parent and (selection_plugin_or_client or selection_userwritable_paths)
falsepositives:
  - Legitimate agent execution on systems where the Oracle Instant Client is installed in home directories as part of a standard build.
level: medium

YARA Rule

rule CVE_2026_105331_Checkmk_MKOracle_Client_Tamper
{
  meta:
    description  = "Detects suspicious strings associated with Checkmk mk-oracle plugin and Oracle Instant Client references (CVE-2026-105331)"
    author       = "valtersit.com"
    date         = "2026-01-28"
    reference    = "https://nvd.nist.gov/vuln/detail/CVE-2026-105331"
    cve          = "CVE-2026-105331"
    tlp          = "CLEAR"
  strings:
    $s1 = "mk-oracle" ascii wide nocase
    $s2 = "check_mk" ascii wide nocase
    $s3 = "check-mk-agent" ascii wide nocase
    $s4 = "instantclient" ascii wide nocase
    $s5 = "ORACLE_HOME" ascii wide
    $s6 = "LD_PRELOAD" ascii wide
  condition:
    (
      (uint32(0) == 0x464c457f) or (uint32(0) == 0x213c6173)
    )
    and 2 of them
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-105331 Checkmk mk-oracle plugin reference observed in clear-text traffic"; flow:to_server,established; content:"mk-oracle"; nocase; content:"instantclient"; distance:0; nocase; threshold:type limit, track by_src, count 1, seconds 600; classtype:attempted-admin; reference:cve,2026-105331; sid:105331001; rev:1;)

Elastic Detection

process where event.type == "start" and process.parent.name : ("check_mk_agent", "cmk-agent-ctl", "check-mk-agent") and (process.name : ("mk-oracle", "*oracle*", "*instantclient*") or process.executable : ("/tmp/*", "/var/tmp/*", "/dev/shm/*"))

Splunk SPL Query

index=endpoint (EventID=1 OR sourcetype=linux:audit) (process_name=*mk-oracle* OR process_name=*oracle* OR process_name=*instantclient*) (parent_process_name=*check_mk* OR parent_process_name=*check-mk*)
| stats count min(_time) as firstTime max(_time) as lastTime by host user parent_process_name process_name process
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="checkmk,cve-2026-105331,">
  <rule id="105331" level="10">
    <if_sid>80700</if_sid>
    <field name="audit.exe">mk-oracle|oracle|instantclient</field>
    <description>CVE-2026-105331: Suspicious execution of Checkmk mk-oracle / Oracle Instant Client by monitoring agent (possible local privilege escalation).</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>

  <rule id="105332" level="12">
    <if_sid>105331</if_sid>
    <field name="audit.execve.a1">/tmp/|/var/tmp/|/dev/shm/|/home/</field>
    <description>CVE-2026-105331: mk-oracle executed from user-writable path (high confidence privilege escalation attempt).</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from tracked sources). Vendor fix: N/A. Workarounds: N/A in provided data.

Immediate mitigations:

1. Restrict filesystem permissions so unprivileged users cannot edit the Oracle Instant Client or its directory referenced by mk-oracle.
2. If mk-oracle is not required on a host, disable/remove the plugin from the agent.
3. Run the Checkmk agent with least privilege where operationally possible, and isolate monitoring agents from general user logins.

Patch/upgrade steps:

• Track Checkmk advisory channels for 2.5.0p10 and later builds (the CVE scope references "before 2.5.0p10"). Until a validated patch reference is available, treat as unpatched and rely on permissions hardening.
• After upgrading to a fixed release, revalidate that mk-oracle no longer resolves the Oracle Instant Client from a user-writable location. Verify plugin invocation paths and that plugin execution is not influenced by user-controlled search paths.

Long-term hardening:

• Enforce secure configuration patterns for agent plugins (treat plugin dependencies as privileged assets).
• Apply file integrity monitoring to agent plugin directories and Oracle Instant Client locations.
• Periodically audit which agents have mk-oracle enabled and why.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-105331
• CWE-426: Untrusted Search Path — https://cwe.mitre.org/data/definitions/426.html
• MITRE ATT&CK T1068: Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/
• CISA KEV Catalog (verify current status) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Checkmk product security advisories (vendor portal) — https://checkmk.com/