CVE-2026-34397

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34397", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-27T13:45:29.619Z", "datePublished": "2026-04-01T17:25:06.034Z", "dateUpdated": "2026-04-04T03:05:13.451Z"}, "containers": {"cna": {"title": "himmelblau: NSS fake-primary group lookup reintroduces name collision risk", "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-v7xx-7mqc-g835", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-v7xx-7mqc-g835"}, {"name": "https://github.com/himmelblau-idm/himmelblau/releases/tag/2.3.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/himmelblau-idm/himmelblau/releases/tag/2.3.9"}, {"name": "https://github.com/himmelblau-idm/himmelblau/releases/tag/3.1.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/himmelblau-idm/himmelblau/releases/tag/3.1.1"}], "affected": [{"vendor": "himmelblau-idm", "product": "himmelblau", "versions": [{"version": ">= 2.0.0-alpha, < 2.3.9", "status": "affected"}, {"version": ">= 3.0.0-alpha, < 3.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T17:25:06.034Z"}, "descriptions": [{"lang": "en", "value": "Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., \"sudo\", \"wheel\", \"docker\", \"adm\") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1."}], "source": {"advisory": "GHSA-v7xx-7mqc-g835", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-04T03:04:22.143352Z", "id": "CVE-2026-34397", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-04T03:05:13.451Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34397", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-04T03:04:22.143352Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-04T03:04:50.577Z"}}], "cna": {"title": "himmelblau: NSS fake-primary group lookup reintroduces name collision risk", "source": {"advisory": "GHSA-v7xx-7mqc-g835", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "himmelblau-idm", "product": "himmelblau", "versions": [{"status": "affected", "version": ">= 2.0.0-alpha, < 2.3.9"}, {"status": "affected", "version": ">= 3.0.0-alpha, < 3.1.1"}]}], "references": [{"url": "https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-v7xx-7mqc-g835", "name": "https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-v7xx-7mqc-g835", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/himmelblau-idm/himmelblau/releases/tag/2.3.9", "name": "https://github.com/himmelblau-idm/himmelblau/releases/tag/2.3.9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/himmelblau-idm/himmelblau/releases/tag/3.1.1", "name": "https://github.com/himmelblau-idm/himmelblau/releases/tag/3.1.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., \"sudo\", \"wheel\", \"docker\", \"adm\") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T17:25:06.034Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34397", "state": "PUBLISHED", "dateUpdated": "2026-04-04T03:05:13.451Z", "dateReserved": "2026-03-27T13:45:29.619Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-01T17:25:06.034Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "himmelblau", "vendor": "himmelblau-idm", "versions": [{"status": "affected", "version": ">= 2.0.0-alpha, < 2.3.9"}, {"status": "affected", "version": ">= 3.0.0-alpha, < 3.1.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*", "matchCriteriaId": "2CA8DCD5-4749-4670-9B02-25F4829C89AF", "versionEndExcluding": "2.3.9", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*", "matchCriteriaId": "09BA6863-CDB1-4212-BB01-8CAB16ABFBE8", "versionEndExcluding": "3.1.1", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., \"sudo\", \"wheel\", \"docker\", \"adm\") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1."}], "id": "CVE-2026-34397", "lastModified": "2026-06-17T10:39:00.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34397", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-04T03:04:22.143352Z", "version": "2.0.3"}}]}, "published": "2026-04-01T18:16:30.330", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/himmelblau-idm/himmelblau/releases/tag/2.3.9"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/himmelblau-idm/himmelblau/releases/tag/3.1.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-v7xx-7mqc-g835"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0-alpha,2.3.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0-alpha,3.1.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "himmelblau", "source": "cna", "vendor": "himmelblau-idm"}, "product": "himmelblau", "vendor": "himmelblau-idm"}], "analysis": {"en": {"generated_at": "2026-04-02T03:45:32.570286+00:00", "value": {"mitigation_remediation": ["Apply the latest patch by upgrading to Himmelblau\u00a02.3.9 or newer, or 3.1.1 or newer, depending on the branch in use.", "Confirm the upgrade by checking the installed version and testing group membership resolution."], "summary": {"action": "Immediate Patch", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected product is the Himmelblau suite from himmelblau\u2011idm. Versions from 2.0.0\u2011alpha through just before 2.3.9 and from 3.0.0\u2011alpha through just before 3.1.1 are compromised, while the patched releases 2.3.9 and 3.1.1 contain the fix.", "description_and_impact": "This vulnerability allows an authenticated user to gain elevated privileges by exploiting a naming collision in the NSS module. When a user\u2019s mapped CN or short name matches that of a privileged local group\u2014such as \"sudo\", \"wheel\" or \"docker\"\u2014the NSS module mistakenly resolves the group name to the user\u2019s fake primary group. If a system performs group\u2011based authorization decisions using NSS results, the attacker can inherit the privileges of the target group, effectively escalating locally.", "risk_and_exploitability": "The CVSS score of 6.3 indicates moderate severity. No EPSS score is available, so the exact exploitation likelihood is uncertain. The vulnerability is not listed in the CISA KEV catalog, but the attack vector is local and requires authentication; any system that relies on NSS for group\u2011based authorization is at risk. The impact is the ability to acquire privileges of a privileged local group."}}}}, "created": "2026-04-02T07:48:10.088655+00:00", "updated": "2026-04-02T20:17:06.903559+00:00", "vendors": ["himmelblau-idm", "himmelblau-idm$PRODUCT$himmelblau"]}