CVE-2026-118380
Description
In MIT krb5 release 1.4 and later, an active network attacker can alter the arguments sent by a legitimate client to RPC services protected by RPCSEC_GSS, or cause return values to be sent in plain text.
Statement
Red Hat has evaluated this vulnerability as having an Important severity because it enables an on-path network attacker to compromise the integrity and confidentiality of administrative RPC sessions protected by RPCSEC_GSS. In standard Red Hat Enterprise Linux deployments, kadmind is not active by default and is typically confined to dedicated Kerberos Key Distribution Center (KDC) systems. The risk is elevated when administrative endpoints are exposed to untrusted or transit networks where an active man-in-the-middle attacker can modify administrative commands or intercept sensitive responses in cleartext.
Mitigation
If remote administration of the Kerberos Key Distribution Center (KDC) is not required, stop and mask the kadmind service and manage the realm locally using kadmin.local:
systemctl stop kadmin.service
systemctl mask kadmin.service
If remote administration is required, restrict network access to the Kerberos administration port (port 749/tcp) to authorized administrator IP addresses or dedicated management subnets using firewalld:
firewall-cmd --permanent --zone=drop --add-port=749/tcp
firewall-cmd --permanent --zone=trusted --add-source=<ADMIN_SUBNET>
firewall-cmd --permanent --zone=trusted --add-port=749/tcp
firewall-cmd --reload
Caveats:
Disabling the kadmind service prevents remote administrative operations via the kadmin client, requiring administrators to execute kadmin.local directly on the KDC host. Restricting or reloading firewall rules will disrupt unauthorized remote sessions and may momentarily interrupt active network connections during rule application.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Confidentiality
Technical Impact: Gain Privileges or Assume Identity
Attackers might be able to modify the message and spoof the endpoint by interfering with the data as it crosses the network or by redirecting the connection to a system under their control. If an attacker can spoof the endpoint, they might gain all the privileges that were intended for the original endpoint.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
