CVE-2026-14852

mk_sap_hana: Privilege escalation via crafted sapstartsrv process name

Published Jul 14, 2026 CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Description

Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. Without an explicit database configuration, the mk_sap_hana agent plugin derives instance identifiers from the process list and uses them to build a command executed with elevated privileges (requires the plugin to run as root with RUNAS=agent).

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Checkmk GmbH

Checkmk

unaffected

Version	Status	Constraints
`2.5.0`	affected	< 2.5.0p9
`2.4.0`	affected	< 2.4.0p34
`2.3.0`	affected	< 2.3.0p49
`2.2.0`	affected	—

No data.

Vendor Product Versions

Checkmk

Version	Status	Scheme	Platform
`[2.5.0,2.5.0p9)`	affected	generic	—
`[2.4.0,2.4.0p34)`	affected	generic	—
`[2.3.0,2.3.0p49)`	affected	generic	—
`2.2.0`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.179% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://checkmk.com/werk/20104

History

Jul 29, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 14, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 10:00 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. Without an explicit database configuration, the mk_sap_hana agent plugin derives instance identifiers from the process list and uses them to build a command executed with elevated privileges (requires the plugin to run as root with RUNAS=agent).
Title		mk_sap_hana: Privilege escalation via crafted sapstartsrv process name
First Time appeared		Checkmk Checkmk checkmk
Weaknesses		CWE-78
CPEs		cpe:2.3:a:checkmk:checkmk:::::::: cpe:2.3:a:checkmk:checkmk:2.2.0:::::::*
Vendors & Products		Checkmk Checkmk checkmk
References		https://checkmk.com/werk/20104
Metrics		cvssV4_0 `{'score': 5.2, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H'}`