EUVD-2026-43652
GHSA-92pj-jr25-ww3p
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required confluence of RUNAS=agent configuration plus absent explicit DB config; S:C and full C/I/A reflect root-level privilege escalation across the privilege boundary.
Primary rating from Vendor (Checkmk).
CVSS VectorVendor: Checkmk
Lifecycle Timeline
2DescriptionCVE.org
Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. Without an explicit database configuration, the mk_sap_hana agent plugin derives instance identifiers from the process list and uses them to build a command executed with elevated privileges (requires the plugin to run as root with RUNAS=agent).
AnalysisAI
Privilege escalation in Checkmk's mk_sap_hana agent plugin allows a local unprivileged user to execute arbitrary commands as root by planting a process whose name mimics a SAP HANA instance. The plugin, when running as root under the RUNAS=agent configuration and lacking explicit database configuration, blindly reads the OS process list to derive SAP HANA instance identifiers and injects them unsanitized into a shell command executed with root privileges - a textbook CWE-78 OS command injection. No public exploit code or CISA KEV listing exists at time of analysis, but the attack prerequisites are achievable on any misconfigured Checkmk deployment that monitors SAP environments.
Technical ContextAI
Checkmk (cpe:2.3:a:checkmk_gmbh:checkmk) is an enterprise IT monitoring platform. The mk_sap_hana agent plugin is designed to collect metrics from SAP HANA database instances. When no explicit database configuration is provided, the plugin falls back to auto-discovery by scanning the running process list for processes that resemble SAP HANA instances. It extracts instance identifiers (such as SID or instance number) from these process names and uses them to construct OS-level monitoring commands. Because these process-derived values are not sanitized before being embedded into a shell command (CWE-78: Improper Neutralization of Special Elements used in an OS Command), an attacker who can introduce a specially named process into the OS process table can inject arbitrary shell metacharacters or command sequences. The escalation requires the Checkmk agent to be configured with RUNAS=agent, which causes the plugin to execute as root - a privilege model commonly used in monitoring agents that need access to privileged system metrics.
RemediationAI
Upgrade to a patched release immediately: Checkmk 2.5.0p9, 2.4.0p34, or 2.3.0p49 as applicable, per the vendor advisory at https://checkmk.com/werk/20104. Version 2.2.0 is End-of-Life and will not receive a patch; users on 2.2.0 must upgrade to a supported branch. If an immediate upgrade is not possible, the specific compensating controls are: first, add an explicit SAP HANA database configuration to the mk_sap_hana plugin - this eliminates the process-list auto-discovery code path that contains the injection flaw, though it requires knowing the actual HANA instance details in advance. Second, disable the RUNAS=agent setting for the mk_sap_hana plugin, which prevents the plugin from running as root and removes the privilege escalation vector at the cost of losing root-level SAP HANA metrics. Third, restrict local shell access on Checkmk monitoring hosts to trusted operators only, raising the barrier for the local access prerequisite. All workarounds should be treated as temporary pending patch deployment.
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, whi
The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dok
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uplo
Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta
The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the W
Local privilege escalation in Checkmk allows site users with high privileges to escalate to root by manipulating site co
Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass
Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credent
A security vulnerability in autocomplete endpoint within the RestAPI of Checkmk (CVSS 8.8) that allows an authenticated
Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escal
Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user t
Cross-Site request forgery in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) could lead to 1-click com
Same weakness CWE-78 – OS Command Injection
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today