EUVD-2026-17983Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 6.3 reflects medium severity: local attack vector (AV:L), high complexity (AC:H), low privileges required (PR:L), high confidentiality and integrity impact. The AC:H and specific naming collision requirement significantly reduce real-world exploitation probability. However, risk assessment must account for the configuration-dependent nature of the impact: systems using NSS for group-based access control (sudo rules, polkit policies) face material risk, while systems using alternative authorization methods (LDAP direct queries, local group databases) are unaffected. No EPSS score provided, but the conditional nature of exploitation (exact name collision + NSS-dependent authorization) suggests exploitation probability is lower than the CVSS score implies. KEV status and public exploit code unavailable; this is likely a low-visibility advisory affecting primarily enterprise Linux deployments integrated with Azure Entra ID. Organizations should prioritize patching based on local authorization architecture and Azure user naming policies. |
| Exploit ScenarioDerived | An authenticated Azure Entra ID user whose CN is set to 'docker' (or any other privileged local group name) logs into a Linux system with Himmelblau 2.3.8 or earlier. The NSS module resolves 'docker' to the attacker's synthetic primary group rather than the actual docker group. If the system uses sudo with a rule like '%docker ALL=(ALL) NOPASSWD: /usr/bin/docker', the attacker can execute privileged commands without additional authentication. No public exploit code is available; successful exploitation requires both a naming collision and NSS-dependent authorization checks on the target system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Local privilege escalation in Himmelblau versions 2.0.0-alpha through 2.3.8 and 3.0.0-alpha through 3.1.0 allows authenticated users to assume privileged group membership when their Azure Entra ID-mapped CN or short name collides with system group names (sudo, wheel, docker, adm, etc.). The NSS module resolves the collision to the attacker's fake primary group, potentially granting group-level privileges if the system uses NSS for authorization decisions. CVSS 6.3 (medium); no public exploit identified at time of analysis.
RemediationAI
Upgrade Himmelblau to version 2.3.9 or later (for 2.x branch) or version 3.1.1 or later (for 3.x branch). The vendor-released patches directly address the NSS group resolution collision logic. Organizations unable to immediately upgrade should review Azure user naming policies to prevent mapped CNs or short names from matching privileged local group names (sudo, wheel, docker, adm, etc.) in their directory. Additionally, audit NSS-dependent authorization policies (sudo rules, polkit configurations) for group-based access controls that could amplify the impact if a naming collision occurs. Detailed remediation guidance is available in the GitHub security advisory at https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-v7xx-7mqc-g835.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Himmelblau is a Linux NSS (Name Service Switch) module and PAM plugin that integrates Microsoft Azure Entra ID identity management into local authentication and group resolution. The vulnerability stems from improper handling of naming collisions in the NSS group resolution pathway (CWE-269: Improper Access Control). When an authenticated Himmelblau user's CN or short name (derived from Azure Entra ID attributes) exactly matches a privileged local group name, the NSS module incorrectly resolves that group identifier to the attacker's synthetic primary group rather than the actual system group. This bypasses the intended separation between Azure identity attributes and local system group membership. The attack surface is constrained by the requirement for exact string matching and NSS-based authorization checks downstream (e.g., sudo, polkit, systemd).
Know when Himmelblau gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., "sudo", "wheel", "docker", "adm") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Himmelblau
View allLocal privilege escalation in Himmelblau prior to versions 3.1.0 and 2.3.8 allows authenticated local users to exploit i
Authorization bypass in Himmelblau (the open-source Entra ID/Intune interoperability suite) versions 2.0.0 through 3.1.4
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Rated high severity (CVSS 7.1), this vu
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Desktop 15 SP7 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Fixed |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | Fixed |
| SUSE Linux Enterprise Server 15 SP7 | Fixed |
| SUSE Linux Enterprise Server 16.0 | Fixed |
| SUSE Linux Enterprise Server 16.1 | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Fixed |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | Fixed |
| SUSE Linux Enterprise Server 15 SP5-LTSS | Fixed |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Fixed |
Exploit-DB