CVE-2026-107778: 
Kerberos vulnerability analysis and mitigation

CVE-2026-107778 is a NULL pointer dereference vulnerability in MIT Kerberos 5 (krb5) through version 1.22.2, located in the make_cred_list() function within src/lib/krb5/krb/rd_cred.c. The flaw allows authenticated Kerberos clients to crash GSS-API acceptor services by sending a malformed KRB-CRED message containing more tickets than ticket_info entries in the encrypted credential part. It was disclosed on October 8, 2026, with patches available the same day. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, Red Hat).

The root cause is a NULL pointer dereference (CWE-476) in make_cred_list() in rd_cred.c. The function iterates over the KRB-CRED.tickets array to determine the credential count, then indexes into the separately decoded EncKrbCredPart.ticket_info array without first verifying both arrays have equal lengths. When a crafted KRB-CRED message contains more tickets than ticket_info entries, the loop reaches the null terminator of the ticket_info array and dereferences a NULL pointer as a krb5_cred_info structure, causing a crash. This code path is reachable via krb5_rd_cred(), which is called from GSS-API credential delegation in accept_sec_context.c; notably, RFC 6448 unencrypted KRB-CRED mode may allow triggering this without full authentication. The fix adds a NULL check for info after the assignment at line 100, returning KRB5KRB_AP_ERR_MODIFIED if the end of ticket_info is reached unexpectedly (krb5 PR #1511, Commit 48afa9a).

Successful exploitation results in a denial of service — specifically, a crash of any GSS-API acceptor service that processes forwarded Kerberos credentials. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Services relying on Kerberos credential delegation (e.g., SSH with GSSAPI forwarding, NFS with Kerberos, or other enterprise services using gss_accept_sec_context()) are at risk of being repeatedly crashed by a single authenticated attacker, potentially disrupting authentication infrastructure across an organization (GitHub Advisory, Red Hat).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability requires low privileges (an authenticated Kerberos account) and no user interaction, with low attack complexity, making it relatively straightforward to trigger once an attacker has valid credentials. The EPSS score is approximately 0.42%, indicating a low but non-negligible probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable (Feedly).

1. Obtain Kerberos credentials: Acquire a valid Kerberos account in the target realm (low-privilege account sufficient).
2. Identify target services: Locate GSS-API acceptor services that accept credential delegation (e.g., SSH servers with GSSAPIDelegateCredentials yes, NFS servers, or custom applications using gss_accept_sec_context()).
3. Craft a malformed KRB-CRED message: Construct a KRB-CRED ASN.1 structure where the tickets array contains more entries than the EncKrbCredPart.ticket_info array. This mismatch causes make_cred_list() to iterate past the end of ticket_info and dereference a NULL pointer.
4. Deliver via credential forwarding: Send the malformed KRB-CRED through the GSS-API credential delegation mechanism (e.g., during an SSH GSSAPI handshake with credential forwarding enabled), triggering krb5_rd_cred() → make_cred_list() on the acceptor side.
5. Crash the service: The NULL dereference causes the acceptor process to crash, resulting in denial of service. Repeat as needed to maintain disruption (krb5 PR #1511, Commit 48afa9a).

• Logs: Unexpected process crashes or segmentation faults in services using GSS-API (e.g., sshd, nfsd, or custom Kerberos-enabled daemons); error messages referencing krb5_rd_cred() or KRB5KRB_AP_ERR_MODIFIED in Kerberos or application logs.
• Network: Repeated GSSAPI authentication attempts from the same source IP that result in service crashes or connection resets; unusual KRB-CRED messages with ticket counts inconsistent with ticket_info entries (detectable via Kerberos protocol analysis).
• Process: Abnormal termination (core dumps) of GSS-API acceptor processes such as sshd or NFS daemons; repeated service restarts triggered by a watchdog or init system following crashes.
• System: Core dump files generated by Kerberos-enabled services in /var/crash/, /tmp/, or application-specific directories following exploitation attempts.

The fix is available in the krb5 master branch (commit 48afa9a) and has been backported to the 1.22-next branch (commit 62196e2, targeting version 1.22.3) (Commit 48afa9a, Commit 62196e2). Organizations should upgrade to krb5 1.22.3 or later once released, or apply the upstream patch directly. As interim mitigations: restrict Kerberos credential delegation to trusted clients only; disable GSSAPI credential forwarding where not required (e.g., set GSSAPIDelegateCredentials no in SSH configurations); and monitor for repeated service crashes in GSS-API acceptor processes (GitHub Advisory, Red Hat).

The vulnerability was reported by researcher TristanInSec via a GitHub pull request to the krb5 project, with the fix reviewed and merged by MIT Kerberos maintainer Greg Hudson (krb5 PR #1511). Red Hat tracked the issue via Bugzilla and Microsoft included it in the October 2026 Patch Tuesday advisory cycle, which was noted by BleepingComputer as part of a record-breaking 1,411-flaw update (Microsoft MSRC). No significant independent researcher commentary or social media discussion beyond standard vulnerability tracking has been observed.