Checkmk CVE-2026-14852

Exploitation requires all of the following specific conditions simultaneously: (1) The mk_sap_hana Checkmk agent plugin must be installed and active on the target host. (2) The plugin must be configured with RUNAS=agent, causing it to execute as root - this is an explicit non-default operator choice. (3) No explicit SAP HANA database configuration must be present in the plugin configuration, forcing the plugin to fall back to auto-discovery via the OS process list. (4) The attacker must have local unprivileged shell access sufficient to spawn a process on the monitored host. Limiting factors: AV:L requires physical or authenticated local access (no remote unauthenticated exploitation path); the flaw is entirely absent in Checkmk deployments not monitoring SAP HANA; explicit HANA DB configuration in the plugin fully eliminates the vulnerable code path regardless of patch status; and the plugin must be scheduled to run (i.e., an agent check cycle must occur) after the malicious process is spawned.

The CVSS 4.0 score of 5.2 (Medium) accurately reflects the constrained real-world risk. The AT:P (Attack Requirements: Present) metric is the key moderating factor: exploitation requires a specific, non-default confluence of conditions - the mk_sap_hana plugin must be active, running as root via RUNAS=agent, and the instance must lack an explicit SAP HANA database configuration. These are not universal defaults; they apply specifically to Checkmk deployments that monitor SAP HANA environments without locking down plugin configuration. The subsequent-system impact metrics (SC:H/SI:H/SA:H) confirm that successful exploitation yields full root compromise of the monitored host. No EPSS data was provided, no POC is publicly available, and no CISA KEV listing exists, indicating no confirmed active exploitation. The real priority signal is environmental: organisations running Checkmk in SAP HANA monitoring roles with RUNAS=agent enabled should treat this as high priority; all others face negligible exposure. The CVSS 4.0 vector appropriately separates the low initial vulnerable-system impact (VC:L/VI:L) from the devastating subsequent-system impact (SC:H/SI:H/SA:H), reflecting the privilege-boundary crossing that defines this flaw.

A local attacker with unprivileged shell access on a Checkmk monitoring server starts a background process whose name is crafted to embed shell metacharacters or a secondary command within what appears to be a SAP HANA instance identifier (e.g., a process named to mimic a HANA SID containing a command substitution). When the mk_sap_hana plugin next executes its scheduled check as root, it reads the process list, extracts the attacker-controlled string as a legitimate instance identifier, and passes it unsanitized into a shell command - executing the injected payload with root privileges. No public proof-of-concept has been identified, but the attack is straightforward for anyone with knowledge of how the plugin parses process names.