Checkmk mk_sap_hana Local Privilege Escalation via Process Spoofing (CVE-2026-14852)

Vulnerability Overview Vulnerability ID: Werk #20104 Vulnerability Title: mk_sap_hana: Privilege escalation via crafted SAP process name Component: mk_sap_hana Date: Jul 7 Severity: Trivial Category: Security Compatibility: Checkmk versions & editions Description: In the absence of explicit database configuration, the agent plugin detects SAP HANA instances from the running process list and constructs a command using a derived instance identifier, which is then executed with elevated privileges. Since any local user can freely modify process names, an attacker can disguise a process as an SAP HANA instance and embed additional commands within that identifier, thereby achieving execution with root privileges. Fix: Post-fix, the plugin only accepts values that exactly match real SAP HANA instances; consequently, attacker-controlled inputs can no longer influence privileged commands. --- Impact Scope Affected Versions: 2.5.0 2.4.0 2.3.0 2.2.0 (EOL) Affected Systems: Systems running the Linux agent with the plugin enabled, where the plugin runs as root and discovers instances in the process list. Privilege escalation requires the component. --- Vulnerability Management CVSS Score: 5.2 (Medium) CVSS Vector: CVE Number: CVE-2026-14852 Related Links: To the list of all Werks --- Additional Information Privacy Policy: The page contains a cookie usage policy, allowing users to choose whether to accept or decline non-essential cookies. Checkmk Version Compatibility: 3.0.0: Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT 2.5.0: Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT 2.4.0p34: Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT 2.3.0p49: Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Ultimate MT --- Summary This vulnerability involves a privilege escalation issue in the plugin, where an attacker can execute privileged commands by forging process names. The fix restricts the plugin to accepting only genuine SAP HANA instance identifiers. The impact primarily affects multiple versions of Checkmk, specifically from 2.2.0 to 2.5.0.

Goal Reached Thanks to every supporter — we hit 100%!

Checkmk mk_sap_hana Local Privilege Escalation via Process Spoofing (CVE-2026-14852)