CVE-2026-107884
Description
In MIT krb5 release 1.15 and later, a client with kadmin administrative privileges can bypass the lockdown_keys attribute by using the password change protocol instead of the kadmin protocol.
Statement
Red Hat has evaluated this vulnerability as having a Moderate security impact because exploitation requires pre-existing, high-privilege authorization equivalent to delegated change-password rights over the targeted principal. Without explicit delegated permissions assigned through administrative ACLs or an authorization plugin, unprivileged or unauthenticated network callers cannot bypass key lockdown controls. In standard Red Hat Enterprise Linux deployments, accounts marked with the key lockdown attribute are sensitive and rarely granted delegated modification access to other users, limiting the blast radius of this flaw to specific non-default configurations.
Mitigation
Audit Kerberos access controls to ensure delegated password-change permissions are not assigned over protected accounts, or restrict network reachability to the kpasswd service.
1. Review the administrative ACL file (typically `/var/kerberos/krb5kdc/kadm5.acl`) and remove entries granting `c` (change-password) permissions over principals configured with `+lockdown_keys`. Restart the Kerberos administration daemon to apply the change:
systemctl restart kadmin.service
2. If remote password changes are not required or should be restricted to trusted administration networks, remove the kpasswd service from the public firewall zone or configure rich rules to limit access to port 464:
firewall-cmd --permanent --remove-service=kpasswd
firewall-cmd --reload
Warning: Modifying ACL permissions will stop delegated operators from performing password changes on those targets. Restricting or blocking port 464 will prevent clients from performing network password changes via kpasswd. Restarting `kadmin.service` or reloading `firewalld` may cause a momentary interruption to active administrative sessions and network traffic.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.7 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.
Acknowledgements
This issue was discovered by Found by AISLE in partnership with Red Hat.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
