CVE-2026-31979: Himmelblau Root Privilege Escalation via Symlink Attack on Kerberos Cache

CVE-2026-31979 (TL-2026-0258), also tracked as GHSA-44wm-q286-ghq3, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-03-20. It has no confirmed attribution, affects Himmelblau Project Himmelblau, references 1 CVE (CVE-2026-31979), maps to 10 MITRE ATT&CK techniques (T1003.008, T1036.005, T1059.004), and is covered by 9 detection rules and 14 indicators of compromise.

Key facts for TL-2026-0258

Threat ID
TL-2026-0258
Also known as
GHSA-44wm-q286-ghq3
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-03-20
Last reviewed
2026-03-20
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, enterprise, financial, healthcare, education, technology
Target regions
Global
Detection rules
9
Indicators of compromise
14

A local privilege escalation vulnerability (CVSS 8.8) in Himmelblau's himmelblaud-tasks daemon allows any local user to gain root access by exploiting symlink-following behavior when writing Kerberos credential cache files to /tmp. The root-privileged daemon follows attacker-controlled symlinks, enabling arbitrary file ownership takeover.

How CVE-2026-31979 works

CVE-2026-31979 is a high-severity local privilege escalation vulnerability in Himmelblau, an open-source Azure Entra ID authentication and Intune compliance suite for Linux. The vulnerability resides in the himmelblaud-tasks daemon, which runs as root and is responsible for managing Kerberos credential cache (ccache) files.

The root cause traces to commit 87a51ee (January 9, 2026) by David Mulder, which modified scripts/gen_servicefiles.py to explicitly filter out the PrivateTmp= directive from the tasks daemon's systemd hardening configuration. This was done to allow the daemon to write Kerberos user credential caches to the shared /tmp directory. However, removing PrivateTmp exposed the daemon to the host's /tmp directory without implementing compensating symlink protections.

Four compounding factors enable exploitation:

1. PrivateTmp Removal: Commit 87a51ee filters PrivateTmp= from the tasks daemon systemd hardening in gen_servicefiles.py, exposing the daemon to the shared host /tmp directory.

2. Directory Creation Follows Symlinks: The create_ccache_dir() function uses DirBuilder::new().recursive(true) combined with std::os::unix::fs::chown() without validating whether the target path contains symbolic links.

3. File Writes Lack O_NOFOLLOW: The write_bytes_to_file() function opens files without O_NOFOLLOW or O_EXCL flags, allowing the daemon to follow attacker-planted symlinks when writing ccache data.

4. Insecure Ccache Path: The ccache directory is hardcoded as /tmp/krb5cc_<uid> in constants.rs, placing sensitive credential operations in a world-writable directory.

The attack chain is straightforward: an unprivileged local user (e.g., uid 1000) creates a symbolic link at /tmp/krb5cc_1000 pointing to a sensitive system directory such as /etc. When Kerberos authentication is triggered, the root-privileged himmelblaud-tasks daemon calls chown("/tmp/krb5cc_1000", 1000, 1000), which follows the symlink and recursively changes ownership of /etc to the attacker. With ownership of /etc, the attacker can modify /etc/passwd, /etc/shadow, or /etc/sudoers to escalate to full root access.

The vulnerability affects all Himmelblau versions from 1.0.0 through 3.0.1 and is patched in versions 3.1.0 and 2.3.8, both released on March 11, 2026. The fix re-enables PrivateTmp and adds proper symlink validation. A temporary mitigation is available by adding a systemd drop-in override to re-enable PrivateTmp=true for the himmelblaud-tasks service.

This vulnerability is particularly concerning for enterprise Linux environments using Himmelblau for Azure Entra ID integration, as these systems typically have multiple local users and the attack requires only low-privilege local access with no user interaction.

MITRE ATT&CK techniques used in TL-2026-0258

credential-access

T1003.008 /etc/passwd and /etc/shadow; T1558 Steal or Forge Kerberos Tickets

defense-evasion

T1036.005 Match Legitimate Resource Name or Location

execution

T1059.004 Unix Shell

privilege-escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

discovery

T1083 File and Directory Discovery

persistence

T1098 Account Manipulation

defense-impairment

T1222.002 Linux and Mac Permissions

impact

T1565.001 Stored Data Manipulation

Affected products and versions in CVE-2026-31979

  • Himmelblau Project — Himmelblau
    Vulnerable versions: >=1.0.0, <3.1.0; >=1.0.0, <2.3.8 (2.x branch)
    Fixed in: 3.1.0; 2.3.8
  • Himmelblau Project — himmelblaud-tasks
    Vulnerable versions: All versions prior to fix — daemon component
    Fixed in: Included in Himmelblau 3.1.0 and 2.3.8

Remediation for CVE-2026-31979

Patches

  • Himmelblau 3.1.0 (released 2026-03-11) — full fix for 3.x branch
  • Himmelblau 2.3.8 (released 2026-03-11) — backport fix for 2.x branch

Immediate actions

  • Upgrade Himmelblau to version 3.1.0 or 2.3.8 immediately
  • Apply systemd drop-in override to re-enable PrivateTmp=true for himmelblaud-tasks service
  • Audit /tmp for suspicious symlinks matching /tmp/krb5cc_* pattern
  • Monitor chown system calls from himmelblaud-tasks for anomalous targets

Workarounds

  • Create systemd drop-in override: /etc/systemd/system/himmelblaud-tasks.service.d/override.conf with [Service] PrivateTmp=true
  • Run systemctl daemon-reload && systemctl restart himmelblaud-tasks after applying override
  • Implement inotify-based monitoring on /tmp/krb5cc_* paths to detect symlink creation

Longer-term hardening

  • Deploy file integrity monitoring (FIM) on /etc/passwd, /etc/shadow, and /etc/sudoers
  • Implement audit rules for symlink creation in /tmp targeting system directories
  • Review all systemd services for PrivateTmp hardening compliance
  • Restrict local user access on systems running Himmelblau where feasible

CVEs associated with CVE-2026-31979

CVE-2026-31979

Weaknesses (CWE) in CVE-2026-31979

CWE-59

Timeline of CVE-2026-31979

  • Commit 87a51ee by David Mulder removes PrivateTmp= from himmelblaud-tasks systemd hardening in scripts/gen_servicefiles.py to allow Kerberos ccache writes to /tmp
  • Himmelblau 3.0.0 released with expanded platform support (Amazon Linux 2023, Gentoo) — includes vulnerable himmelblaud-tasks configuration
  • Himmelblau 3.0.1 released with AWS-LC PKCS7 fix — still includes symlink vulnerability
  • GitHub Security Advisory GHSA-44wm-q286-ghq3 published by reporter khronosd detailing symlink LPE in himmelblaud-tasks
  • CVE-2026-31979 assigned with CVSS 8.8 (High); Himmelblau 3.1.0 and 2.3.8 released as security patches
  • Akamai publishes detailed technical research blog with full exploit chain analysis and PoC walkthrough
  • As of 2026-05-29, CVE-2026-31979 (Himmelblau himmelblaud-tasks symlink LPE, CVSS 8.8/7.8) remains PATCHED: vendor fixes shipped in 3.1.0 and 2.3.8 on 2026-03-11, with SUSE/openSUSE distro updates following in April 2026. It is NOT in CISA KEV and shows no reported in-the-wild exploitation; it stays a local, PoC-only, unattributed bug, so no successor supersedes it.

Sources cited for CVE-2026-31979

Threats related to CVE-2026-31979

Detection coverage for TL-2026-0258

As of 2026-03-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0258 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats