{}

{}

{}

{"acknowledgement": "This issue was discovered by Found by AISLE in partnership with Red Hat.", "bugzilla": {"description": "krb5: Unauthorized key reset of protected principal via kpasswd", "id": "2478672", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478672"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-620", "details": ["In MIT krb5 release 1.15 and later, a client with kadmin administrative privileges can bypass the lockdown_keys attribute by using the password change protocol instead of the kadmin protocol."], "mitigation": {"lang": "en:us", "value": "Audit Kerberos access controls to ensure delegated password-change permissions are not assigned over protected accounts, or restrict network reachability to the kpasswd service.\n1. Review the administrative ACL file (typically `/var/kerberos/krb5kdc/kadm5.acl`) and remove entries granting `c` (change-password) permissions over principals configured with `+lockdown_keys`. Restart the Kerberos administration daemon to apply the change:\n```\nsystemctl restart kadmin.service\n```\n2. If remote password changes are not required or should be restricted to trusted administration networks, remove the kpasswd service from the public firewall zone or configure rich rules to limit access to port 464:\n```\nfirewall-cmd --permanent --remove-service=kpasswd\nfirewall-cmd --reload\n```\nWarning: Modifying ACL permissions will stop delegated operators from performing password changes on those targets. Restricting or blocking port 464 will prevent clients from performing network password changes via kpasswd. Restarting `kadmin.service` or reloading `firewalld` may cause a momentary interruption to active administrative sessions and network traffic."}, "name": "CVE-2026-107884", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-09T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107884\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107884"], "statement": "Red Hat has evaluated this vulnerability as having a Moderate security impact because exploitation requires pre-existing, high-privilege authorization equivalent to delegated change-password rights over the targeted principal. Without explicit delegated permissions assigned through administrative ACLs or an authorization plugin, unprivileged or unauthenticated network callers cannot bypass key lockdown controls. In standard Red Hat Enterprise Linux deployments, accounts marked with the key lockdown attribute are sensitive and rarely granted delegated modification access to other users, limiting the blast radius of this flaw to specific non-default configurations.", "threat_severity": "Moderate"}

{}