HIGH🇵🇱 Wersja polska

CVE-2026-31979

CVSS 8.8v3.1pub. 2026-03-11upd. 2026-03-16

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulnerability is fixed in 3.1.0 and 2.3.8.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Himmelblau Idm Himmelblau
APP
Himmelblau-Idm
1.0.0 – 2.3.8 (bez)3.0.0 – 3.1.0 (bez)

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

Tags

LPE

CWE

References

github.com/himmelblau-idm/himmelblau/security/advisorie…

Related vulnerabilities

CVE-2026-31957CRITICAL10.0PL ✓ten sam produkt

Himmelblau: brak ograniczenia do tenanta przy uwierzytelnianiu Entra ID

CVE-2025-54882HIGH7.1ten sam produkt

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9...

CVE-2026-34397MEDIUM6.3ten sam produkt

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to ...