omd: Local privilege escalation when executing omd commands as root

Successful exploitation of CVE-2025-39666 allows an authenticated site user to gain root access on the Checkmk server. This represents a significant security risk, as a malicious actor with root privileges can compromise the entire system, including sensitive data, configuration files, and other critical resources. The attacker could install malware, modify system settings, or exfiltrate data without detection. The blast radius extends to any data or services hosted on the compromised Checkmk server, potentially impacting other systems within the network if Checkmk is used for monitoring those systems.

Organizations using Checkmk for monitoring, particularly those with multiple site users and less restrictive file permissions, are at risk. Environments where the omd command is frequently used or accessible to a wide range of users are especially vulnerable. Legacy Checkmk installations running older, unsupported versions are also at increased risk.

• linux / server:

find /omd/sites/*/ -type f -perm -u=w -print0 | xargs -0 ls -l | grep 'site_user:'

• linux / server:

journalctl -u checkmk_agent -g 'omd command' | grep -i error

• linux / server:

ps aux | grep -i omd

1. 2026-04-07Disclosure

   disclosure

1. आरक्षित2025-04-16
2. प्रकाशित2026-04-07
3. EPSS अद्यतन2026-04-15

The primary mitigation for CVE-2025-39666 is to upgrade Checkmk to version 2.5.0b3 or later. If an immediate upgrade is not possible, restrict access to the omd command and carefully review any files processed by it. Implement strict file permissions on the site context directory to prevent unauthorized modifications. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests targeting the omd command, although this is not a primary defense. After upgrading, confirm the fix by attempting to execute the omd command as a site user and verifying that privilege escalation is prevented.