CVE-2026-118380

{}

{}

{}

{"bugzilla": {"description": "krb5: kadmind: request alteration and protected information disclosure", "id": "2563461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563461"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-924", "details": ["In MIT krb5 release 1.4 and later, an active network attacker can alter the arguments sent by a legitimate client to RPC services protected by RPCSEC_GSS, or cause return values to be sent in plain text."], "mitigation": {"lang": "en:us", "value": "If remote administration of the Kerberos Key Distribution Center (KDC) is not required, stop and mask the kadmind service and manage the realm locally using kadmin.local:\n```\nsystemctl stop kadmin.service\nsystemctl mask kadmin.service\n```\nIf remote administration is required, restrict network access to the Kerberos administration port (port 749/tcp) to authorized administrator IP addresses or dedicated management subnets using firewalld:\n```\nfirewall-cmd --permanent --zone=drop --add-port=749/tcp\nfirewall-cmd --permanent --zone=trusted --add-source=<ADMIN_SUBNET>\nfirewall-cmd --permanent --zone=trusted --add-port=749/tcp\nfirewall-cmd --reload\n```\nCaveats:\nDisabling the kadmind service prevents remote administrative operations via the kadmin client, requiring administrators to execute kadmin.local directly on the KDC host. Restricting or reloading firewall rules will disrupt unauthorized remote sessions and may momentarily interrupt active network connections during rule application."}, "name": "CVE-2026-118380", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Out of support scope", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-09T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118380\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118380"], "statement": "Red Hat has evaluated this vulnerability as having an Important severity because it enables an on-path network attacker to compromise the integrity and confidentiality of administrative RPC sessions protected by RPCSEC_GSS. In standard Red Hat Enterprise Linux deployments, kadmind is not active by default and is typically confined to dedicated Kerberos Key Distribution Center (KDC) systems. The risk is elevated when administrative endpoints are exposed to untrusted or transit networks where an active man-in-the-middle attacker can modify administrative commands or intercept sensitive responses in cleartext.", "threat_severity": "Important"}

{"created": "2026-11-11T20:30:19.352245+00:00", "updated": "2026-11-13T07:00:10.515444+00:00", "vendors": []}