Himmelblau CVE-2026-45108

Vendor-released patch: upgrade to Himmelblau 3.1.5 (3.x deployments) or 2.3.11 (2.3.x maintenance line) per advisory GHSA-pmxh-j4r6-88mv (https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-pmxh-j4r6-88mv). There is no documented configuration-only workaround for the username-matching flaw, so patching is the primary control. As interim compensating measures until you can upgrade, restrict which Entra ID accounts are permitted to establish local Unix sessions on sensitive hosts (tighten Himmelblau's allowed-users/groups mapping so far fewer domain members can authenticate), and limit shared multi-user access to high-value systems - the trade-off is reduced login flexibility for legitimate users. Increase auditing of local logins versus the expected user-to-host mapping to detect impersonation, and constrain or review multi-domain alias configurations since the bug is exacerbated where multiple domains/aliases are accepted; tightening alias acceptance may break legitimate cross-domain logins, so validate against your tenant topology before applying.