# CVE-2024-47091: Checkmk mk_mysql agent plugin privilege escalation on Windows

Source: https://junglewise.ai/threats/cve-2024-47091-checkmk-mk-mysql-agent-plugin-privilege-escalation-on-windows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2024-47091 · Severity: info · CVSS 5.2 · Published 2026-05-13

Checkmk is an IT infrastructure monitoring solution. A security flaw in its Windows monitoring agent allows a local user with limited permissions to gain full administrative (SYSTEM) control over the computer. This occurs because the agent incorrectly trusts certain Windows service names and binary paths, which an attacker could manipulate to run their own malicious code.

## Quick answers

**Is CVE-2024-47091 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-47091 being exploited in the wild.

**How severe is CVE-2024-47091?** Informational severity, with a CVSS score of 5.2, published 13 May 2026.

**Which products and versions are affected?** Checkmk GmbH Checkmk < 2.4.0p29, < 2.3.0p47, 2.2.0 (EOL).

**Is there a fix for CVE-2024-47091?** A patch was published on 2026-04-24: Vendor fix released in Werk #19198 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-47091 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2024-47091?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The mk_mysql agent plugin for Windows discovers database instances by querying Windows services matching 'MySQL' or 'MariaDB' and executing commands based on the service's binary path. This creates an uncontrolled search path (CWE-427) vulnerability. A local unprivileged user who can create a service with these names, or who has write access to the binary referenced by such a service, can trick the Checkmk agent into executing arbitrary code. Since the Checkmk agent typically runs with SYSTEM privileges, this results in local privilege escalation. The issue is fixed in versions 2.4.0p29 and 2.3.0p47.

## Affected products

- Checkmk GmbH Checkmk < 2.4.0p29, < 2.3.0p47, 2.2.0 (EOL)

## Timeline

- 2026-04-24: patched: Vendor fix released in Werk #19198
- 2026-05-13: advisory: CVE published and NVD entry created

## References

- [https://checkmk.com/werk/19198](https://checkmk.com/werk/19198)