CVE-2026-111423

{}

{}

{}

{"acknowledgement": "This issue was discovered by Found by AISLE in partnership with Red Hat.", "bugzilla": {"description": "krb5: Improper authorization via flawed PAC checksum verification", "id": "2479394", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479394"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-354", "details": ["In MIT krb5 release 1.21 and later, server applications will erroneously treat the PAC within a ticket as verified when the server checksum is invalid."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-111423", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-09T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-111423\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-111423"], "statement": "This vulnerability is rated as a Moderate impact because exploitation does not allow an unauthenticated authentication bypass and requires an authenticated client to send crafted authorization data to services that explicitly consume PAC attributes for access control decisions. In standard Red Hat Enterprise Linux environments, core Kerberos ticket exchange security is preserved, limiting risk to specific configurations relying on Microsoft PAC authorization extensions. The potential impact is therefore constrained to authorization inconsistencies in affected consumer services rather than broader system takeover.", "threat_severity": "Moderate"}

{"created": "2026-11-11T18:15:21.819321+00:00", "updated": "2026-11-13T03:30:14.025620+00:00", "vendors": []}