CVE-2025-54882
Himmelblau's Kerberos credential cache collection is world readable
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Himmelblau's Kerberos credential cache collection is world readable
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.
Reserved 2025-07-31 | Published 2025-08-07 | Updated 2025-08-07 | Assigner GitHub_MCWE-522: Insufficiently Protected Credentials
github.com/...elblau/security/advisories/GHSA-phfx-rjfw-wj83
github.com/...ommit/b562053df3dffb1dd9ab3d09af986886773be2ad
github.com/...ommit/faae58b0384aca8b21b4be5f1c507412eec3778a
github.com/himmelblau-idm/himmelblau/releases/tag/0.9.22
github.com/himmelblau-idm/himmelblau/releases/tag/1.2.0
Support options
