CVE-2026-31979 Details
Description
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulnerability is fixed in 3.1.0 and 2.3.8.
A local privilege escalation vulnerability has been identified in the Himmelblau interoperability suite for Microsoft Azure Entra ID and Intune. This issue affects versions 1.0.0 and later, prior to 3.1.0 and 2.3.8. The vulnerability arises because the himmelblaud-tasks daemon, running as root, creates Kerberos cache files in the /tmp directory without proper symlink protections. A local user can exploit this by creating a symlink to a sensitive directory, such as /etc, which the daemon will inadvertently follow, allowing the user to take ownership of critical system files or directories.
Users can re-enable PrivateTmp for the himmelblaud-tasks service via a systemd drop-in, which will block the symlink attack vector. After applying the override, systemctl daemon-reload and systemctl restart himmelblaud-tasks should be executed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-44wm-q286-ghq3 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| himmelblau-idm himmelblau | >= 1.0.0, < 2.3.8 >= 3.0.0, < 3.1.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 16, 2026 | Initial Analysis | [email protected] |
| Mar 11, 2026 | New CVE Received | [email protected] |