Executive brief
Checkmk is an IT infrastructure monitoring solution. A security flaw in its Windows monitoring agent allows a local user with limited permissions to gain full administrative (SYSTEM) control over the computer. This occurs because the agent incorrectly trusts certain Windows service names and binary paths, which an attacker could manipulate to run their own malicious code.
Technical details
The mk_mysql agent plugin for Windows discovers database instances by querying Windows services matching 'MySQL' or 'MariaDB' and executing commands based on the service's binary path. This creates an uncontrolled search path (CWE-427) vulnerability. A local unprivileged user who can create a service with these names, or who has write access to the binary referenced by such a service, can trick the Checkmk agent into executing arbitrary code. Since the Checkmk agent typically runs with SYSTEM privileges, this results in local privilege escalation. The issue is fixed in versions 2.4.0p29 and 2.3.0p47.
Affected products
- Checkmk GmbH Checkmk < 2.4.0p29, < 2.3.0p47, 2.2.0 (EOL)
Timeline
- 2026-04-24: patched: Vendor fix released in Werk #19198
- 2026-05-13: advisory: CVE published and NVD entry created