Skip to main content

Himmelblau CVE-2026-31979

HIGH
Improper Link Resolution Before File Access (CWE-59)
2026-03-11 security-advisories@github.com
Privilege Escalation Microsoft Himmelblau Suse Himmelblau Idm
8.8
CVSS 3.1 · GitHub Advisory
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Create symlink in /tmp pointing to target file
  2. Exploit
    himmelblaud-tasks writes Kerberos cache to symlink
  3. Execution
    Arbitrary file overwritten or chowned
  4. Impact
    Local privilege escalation achieved

Vulnerability Assessment

Weakness
CWE
CWE-59
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
Exploitation Conditions

Local user account required. himmelblaud-tasks daemon (versions < 3.1.0 or < 2.3.8) running as root with PrivateTmp disabled in systemd hardening. Kerberos cache files written to world-writable /tmp directory without symlink protections.
Impact

CVSS 8.8 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: Low. User interaction: None. Exploitable via local access.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Local privilege escalation in Himmelblau prior to versions 3.1.0 and 2.3.8 allows authenticated local users to exploit insecure Kerberos cache file handling in the root-running himmelblaud-tasks daemon through symlink attacks. The vulnerability stems from the removal of PrivateTmp protections, exposing /tmp operations to symlink-based file overwrite and ownership manipulation attacks. An attacker with local access can leverage this flaw to achieve arbitrary file modification and full system compromise.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 22:07 CVSS 8.8

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. versions up to 3.1.0 is affected by improper link resolution before file access (CVSS 8.8).

RemediationAI

Fixed in version 3.1.0.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability (CWE-59: Improper Link Resolution Before File Access) affects Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.. Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulne

Know when Himmelblau gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SUSE HIGH

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

DescriptionGitHub Advisory

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulnerability is fixed in 3.1.0 and 2.3.8.

Executive ViewAI

Why It Matters

A critical local privilege escalation vulnerability exists in Himmelblau (Azure Entra ID/Intune interoperability) affecting versions prior to 3.1.0 and 2.3.8. Any local user on affected systems can exploit symlink attacks to gain root-level access, potentially compromising identity infrastructure and downstream cloud resources. Organizations using Himmelblau for Azure identity federation must prioritize immediate remediation.

Business Impact: High
Compensating Controls

Since no patch is currently available: (1) Restrict local shell access to Himmelblau daemon hosts via PAM/login policies—allow only trusted service accounts; (2) Enable SELinux or AppArmor with strict policies preventing /tmp access by himmelblaud-tasks; (3) Use systemd-tmpfiles to enforce immutable /tmp/krb5cc_* permissions; (4) Isolate Himmelblau hosts on dedicated subnets with egress monitoring; (5) Configure auditd to monitor /tmp symlink creation and himmelblaud-tasks process execution; (6) Monitor for CVE-2026-31979 patch releases from Himmelblau project daily.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*
cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*

Related Vulnerabilities in Himmelblau Authentication and File Handling Flaws

View all 2
CVE-2026-31957 CRITICAL
10.0

More in Himmelblau

View all
CVE-2026-45108 HIGH
8.4 May 27

Authorization bypass in Himmelblau (the open-source Entra ID/Intune interoperability suite) versions 2.0.0 through 3.1.4
CVE-2026-34397 MEDIUM
6.3 Apr 01

Local privilege escalation in Himmelblau versions 2.0.0-alpha through 2.3.8 and 3.0.0-alpha through 3.1.0 allows authent
CVE-2025-54882 HIGH POC
7.1 Aug 07

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Rated high severity (CVSS 7.1), this vu

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2020-0787 HIGH POC
7.8
CVE-2015-1130 HIGH POC
7.8
CVE-2015-5287 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2019-1069 HIGH POC
7.8
CVE-2026-81963 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.86 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.110 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.112 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.100 Image SL-Micro Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed

References

Advisories & patches
ADVISORY https://vuldb.com/?id.350557 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1361/ REF https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-44wm-q286-ghq3

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy