CVE-2026-31979
High · 8.8CVSS
8.8
EPSS
0.2%
Published
Mar 11, 2026
CISA due date
—
The record
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulnerability is fixed in 3.1.0 and 2.3.8.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | himmelblau | 0 | 2.3.8+git0.dec3693-160000.1.1 |
| openSUSE:Tumbleweed | himmelblau | 0 | 2.3.8+git0.dec3693-1.1 |
Related vulnerabilities
- CVE-2026-45108 Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Also affects himmelblau
- CVE-2026-25727 time provides date and time handling in Rust. Also affects himmelblau
- CVE-2026-34397 Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Also affects himmelblau
- CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. CWE-59
- CVE-2026-113716 virtualenv is a tool for creating isolated virtual python environments. CWE-59
- CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-59
- CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. CWE-59
- CVE-2026-109274 ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race… CWE-59