Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-26T12:09:54 Apache Kerby: org.apache.kerby/kerb-server: Apache Kerby: Kerberos pre-authentication bypass via unrecognized PA-DATA 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CWE-358

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

A flaw was found in Apache Kerby. An attacker can bypass the Kerberos pre-authentication check by sending a Pre-Authentication Data (PA-DATA) packet with an unrecognized or unsupported type. This vulnerability allows an attacker to circumvent the initial authentication step, potentially leading to unauthorized access or impersonation within a Kerberos-protected environment.

This is an Important flaw in Apache Kerby, affecting Red Hat products that utilize Kerberos for authentication, including Red Hat AMQ, JBoss Data Grid, Enterprise Application Platform, and Red Hat JBoss Fuse. The vulnerability allows an attacker to bypass the Kerberos pre-authentication check by sending a specially crafted Pre-Authentication Data (PA-DATA) packet. This circumvents an initial authentication step, potentially leading to unauthorized access or impersonation within a Kerberos-protected environment. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat AMQ Clients Affected kerb-server Red Hat Data Grid 8 Not affected kerb-server Red Hat Data Grid 8 Not affected kerb-server-api-all Red Hat Fuse 7 Not affected kerb-server Red Hat JBoss Enterprise Application Platform Expansion Pack Affected kerb-server Red Hat JBoss Enterprise Application Platform Expansion Pack Affected kerb-server-api-all streams for Apache Kafka 2 Affected kerb-server streams for Apache Kafka 3 Affected kerb-server https://www.cve.org/CVERecord?id=CVE-2026-57915 https://nvd.nist.gov/vuln/detail/CVE-2026-57915 https://lists.apache.org/thread/1y3glgh3kzwoxo5m2lq504cjlh1dsrfh