Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-11-09T15:00:00 krb5: Alteration of authentication indicators in CAMMAC container 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CWE-354

In MIT krb5 release 1.14 and later (since authentication indicator support was added), an authenticated attacker can bypass authentication indicator requirements using an unkeyed checksum in the CAMMAC authdata container.

Red Hat Product Security rates this vulnerability as Important because an authenticated user within a Kerberos realm can circumvent access control policies that enforce specific authentication indicators, such as multi-factor authentication requirements. Although exploitation relies on valid realm credentials, successful manipulation undermines trust boundaries across indicator-protected services without administrative privileges. Deployments that do not enforce authentication indicators on service principals are not exposed to this security policy bypass. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 2026-11-12T00:00:00Z RHSA-2026:99624 krb5-0:1.21.3-11.el10_3.2 Red Hat Enterprise Linux 10.2 Extended Update Support 2026-11-12T00:00:00Z RHSA-2026:99625 krb5-0:1.21.3-10.el10_2.2 Red Hat Enterprise Linux 9 2026-11-12T00:00:00Z RHSA-2026:99715 krb5-0:1.21.1-10.el9_9.2 Red Hat Enterprise Linux 9 2026-11-12T00:00:00Z RHSA-2026:99715 krb5-0:1.21.1-10.el9_9.2 Red Hat Enterprise Linux 9.8 Extended Update Support 2026-11-12T00:00:00Z RHSA-2026:99716 krb5-0:1.21.1-10.el9_8.3 Red Hat Hardened Images 2026-11-10T00:00:00Z RHSA-2026:97811 krb5-main-1.22.3-0.1.hum1 Red Hat Enterprise Linux 6 Out of support scope krb5 Red Hat Enterprise Linux 7 Affected krb5 Red Hat Enterprise Linux 8 Affected krb5 https://www.cve.org/CVERecord?id=CVE-2026-71199 https://nvd.nist.gov/vuln/detail/CVE-2026-71199