# CVE-2026-31979: Himmelblau Root Privilege Escalation via Symlink Attack on Kerberos Cache

> A local privilege escalation vulnerability (CVSS 8.8) in Himmelblau's himmelblaud-tasks daemon allows any local user to gain root access by exploiting symlink-following behavior when writing Kerberos credential cache files to /tmp. The root-privileged daemon follows attacker-controlled symlinks, enabling arbitrary file ownership takeover.

- **Published:** 2026-03-20T12:00:00Z
- **Last reviewed:** 2026-03-20T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0258
- **ID:** TL-2026-0258
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-31979

## Description

CVE-2026-31979 is a high-severity local privilege escalation vulnerability in Himmelblau, an open-source Azure Entra ID authentication and Intune compliance suite for Linux. The vulnerability resides in the himmelblaud-tasks daemon, which runs as root and is responsible for managing Kerberos credential cache (ccache) files.

The root cause traces to commit 87a51ee (January 9, 2026) by David Mulder, which modified scripts/gen_servicefiles.py to explicitly filter out the PrivateTmp= directive from the tasks daemon's systemd hardening configuration. This was done to allow the daemon to write Kerberos user credential caches to the shared /tmp directory. However, removing PrivateTmp exposed the daemon to the host's /tmp directory without implementing compensating symlink protections.

Four compounding factors enable exploitation:

1. PrivateTmp Removal: Commit 87a51ee filters PrivateTmp= from the tasks daemon systemd hardening in gen_servicefiles.py, exposing the daemon to the shared host /tmp directory.

2. Directory Creation Follows Symlinks: The create_ccache_dir() function uses DirBuilder::new().recursive(true) combined with std::os::unix::fs::chown() without validating whether the target path contains symbolic links.

3. File Writes Lack O_NOFOLLOW: The write_bytes_to_file() function opens files without O_NOFOLLOW or O_EXCL flags, allowing the daemon to follow attacker-planted symlinks when writing ccache data.

4. Insecure Ccache Path: The ccache directory is hardcoded as /tmp/krb5cc_<uid> in constants.rs, placing sensitive credential operations in a world-writable directory.

The attack chain is straightforward: an unprivileged local user (e.g., uid 1000) creates a symbolic link at /tmp/krb5cc_1000 pointing to a sensitive system directory such as /etc. When Kerberos authentication is triggered, the root-privileged himmelblaud-tasks daemon calls chown("/tmp/krb5cc_1000", 1000, 1000), which follows the symlink and recursively changes ownership of /etc to the attacker. With ownership of /etc, the attacker can modify /etc/passwd, /etc/shadow, or /etc/sudoers to escalate to full root access.

The vulnerability affects all Himmelblau versions from 1.0.0 through 3.0.1 and is patched in versions 3.1.0 and 2.3.8, both released on March 11, 2026. The fix re-enables PrivateTmp and adds proper symlink validation. A temporary mitigation is available by adding a systemd drop-in override to re-enable PrivateTmp=true for the himmelblaud-tasks service.

This vulnerability is particularly concerning for enterprise Linux environments using Himmelblau for Azure Entra ID integration, as these systems typically have multiple local users and the attack requires only low-privilege local access with no user interaction.

## MITRE ATT&CK

- T1059.004 Unix Shell
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1222.002 Linux and Mac Permissions
- T1036.005 Match Legitimate Resource Name or Location
- T1558 Steal or Forge Kerberos Tickets
- T1003.008 /etc/passwd and /etc/shadow
- T1098 Account Manipulation
- T1083 File and Directory Discovery
- T1565.001 Stored Data Manipulation

## Sources

- [Akamai: CVE-2026-31979 The Symlink Trap — Root Privilege Escalation in Himmelblau](https://www.akamai.com/blog/security-research/2026/mar/cve-2026-31979-symlink-root-privilege-escalation-himmelblau)
- [GitHub Security Advisory: GHSA-44wm-q286-ghq3 — himmelblaud-tasks LPE via /tmp symlink](https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-44wm-q286-ghq3)
- [Himmelblau LPE via Symlink Attack (CVE-2026-31979) — TheHackerWire](https://www.thehackerwire.com/himmelblau-lpe-via-symlink-attack-cve-2026-31979/)
- [Himmelblau v3.1.0 Security Release — GitHub Releases](https://github.com/himmelblau-idm/himmelblau/releases/tag/v3.1.0)
- [Himmelblau v2.3.8 Security Patch — GitHub Releases](https://github.com/himmelblau-idm/himmelblau/releases/tag/v2.3.8)
- [Commit 87a51ee — Removal of PrivateTmp from himmelblaud-tasks systemd hardening](https://github.com/himmelblau-idm/himmelblau/commit/87a51ee)
- [Himmelblau GitHub Repository — Azure Entra ID Authentication for Linux](https://github.com/himmelblau-idm/himmelblau)
- [CWE-59: Improper Link Resolution Before File Access](https://cwe.mitre.org/data/definitions/59.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0258