CVE-2026-31979

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulnerability is fixed in 3.1.0 and 2.3.8.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-44wm-q286-ghq3	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:himmelblau-idm:himmelblau::::::::
	cpe:2.3:a:himmelblau-idm:himmelblau::::::::

History

No history.

Information

Published : 2026-03-11 20:16

Updated : 2026-03-16 18:18

NVD link : CVE-2026-31979

Mitre link : CVE-2026-31979

CVE.ORG link : CVE-2026-31979

JSON object : View

Products Affected

himmelblau-idm

himmelblau

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2026-31979", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2026-03-11T20:16:17.607", "references": [{"url": "https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-44wm-q286-ghq3", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulnerability is fixed in 3.1.0 and 2.3.8."}, {"lang": "es", "value": "Himmelblau es una suite de interoperabilidad para Microsoft Azure Entra ID e Intune. Antes de las versiones 3.1.0 y 2.3.8, el demonio himmelblaud-tasks, ejecut\u00e1ndose como root, escribe archivos de cach\u00e9 de Kerberos bajo /tmp/krb5cc_ sin protecciones de enlaces simb\u00f3licos. Desde el commit 87a51ee, PrivateTmp se elimina expl\u00edcitamente del endurecimiento de systemd del demonio de tareas, exponi\u00e9ndolo al /tmp del host. Un usuario local puede explotar esto mediante ataques de enlaces simb\u00f3licos para cambiar el propietario (chown) o sobrescribir archivos arbitrarios, logrando una escalada de privilegios local. Esta vulnerabilidad est\u00e1 corregida en las versiones 3.1.0 y 2.3.8."}], "lastModified": "2026-03-16T18:18:34.750", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C66E65F5-D68D-43EC-B26B-7680565AA1DD", "versionEndExcluding": "2.3.8", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1484B22D-EA09-40C2-B943-0EEAB8D2FA99", "versionEndExcluding": "3.1.0", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}