CVE-2026-107884: 
Kerberos vulnerability analysis and mitigation

CVE-2026-107884 is an authentication bypass vulnerability in MIT Kerberos 5 (krb5) that allows a client with kadmin administrative privileges to bypass the lockdown_keys attribute (KRB5_KDB_LOCKDOWN_KEYS) by using the password change protocol (kpasswd/RFC3244) instead of the standard kadmin RPC protocol. It affects MIT krb5 release 1.15 and later, with the specific component identified as src/kadmin/server/misc.c (schpw_util_wrapper()). The vulnerability was reported on 2026-05-18 and published on 2026-11-09, with a CVSS v3.1 base score of 6.7 (Medium/High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a logic error classified as CWE-620 (Unverified Password Change): the schpw_util_wrapper() function in src/kadmin/server/misc.c authorizes the OP_CPW (change password) operation but does not subsequently enforce the KRB5_KDB_LOCKDOWN_KEYS attribute on the target principal before calling kadm5_chpass_principal_util(). By contrast, the kadmind RPC path explicitly calls check_lockdown_keys() and converts KADM5_PROTECT_KEYS into an authorization failure (KADM5_AUTH_CHANGEPW). An attacker exploits this by submitting an RFC3244 set-password request naming a +lockdown_keys-protected principal as the explicit target, bypassing the protection that the RPC path enforces. Exploitation requires network access to the kpasswd service, a valid authenticated principal, and delegated c/OP_CPW rights over the target principal (via kadm5.acl or an auth plugin) (Red Hat Bugzilla).

Successful exploitation allows an attacker with delegated change-password privileges to reset the password of a Kerberos principal explicitly protected by +lockdown_keys, defeating a security control designed to prevent modification of sensitive principals. This results in high confidentiality and integrity impact — the attacker gains effective control over the compromised principal's secrets and any access tied to it — and a low availability impact, as the legitimate principal's access is disrupted until recovery. In environments where locked-down principals represent service accounts or privileged identities, this could enable lateral movement or privilege escalation (Red Hat Bugzilla, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat CVE). The CVE status remains "Reserved" and no patch has been released as of the publication date. Exploitation requires an authenticated principal with delegated OP_CPW rights over a +lockdown_keys-protected target, limiting the practical attack surface to misconfigured or intentionally permissive ACL environments. No CISA KEV catalog entry or threat actor attribution has been identified for this vulnerability.

1. Reconnaissance: Identify a Kerberos environment running MIT krb5 1.15 or later with the kpasswd service (UDP/TCP port 464) network-accessible. Confirm that one or more principals are marked +lockdown_keys.
2. Obtain delegated privileges: Acquire or compromise an authenticated Kerberos principal that has been granted c (change-password / OP_CPW) rights over the target +lockdown_keys principal via kadm5.acl (e.g., attacker@REALM c victim@REALM) or an equivalent auth plugin.
3. Obtain a Kerberos ticket: Run kinit attacker@REALM to obtain a valid TGT for the attacker principal.
4. Submit RFC3244 set-password request: Use a client that calls krb5_set_password() or krb5_set_password_using_ccache() with the target principal explicitly set to victim@REALM, sending the request to the kpasswd service rather than the kadmind RPC port.
5. Confirm bypass: Observe that the password change succeeds (logged as setpw request ... by attacker ... for victim: success), whereas the equivalent kadmin cpw RPC command for the same target would be denied with KADM5_AUTH_CHANGEPW.
6. Leverage compromised principal: Use the newly set password to authenticate as the victim principal and access any resources or services tied to that identity (Red Hat Bugzilla).

• Logs: Kerberos/kadmind log entries containing setpw request targeting principals known to be marked +lockdown_keys, particularly where the requesting principal is not the target (cross-principal password change); unexpected successful password change events for sensitive or service principals.
• Network: Unusual or unexpected connections to the kpasswd service (UDP/TCP port 464) from hosts that are not designated administrative workstations; RFC3244 set-password requests originating from non-standard clients.
• Process/Configuration: Review of kadm5.acl for entries granting c or OP_CPW rights over principals with +lockdown_keys; unexpected modifications to ACL files that could grant such rights (Red Hat Bugzilla).

No released package fix is available as of the publication date. The proposed upstream fix mirrors the existing RPC-side lockdown check inside schpw_util_wrapper() by calling a local check_lockdown_keys_local() function before invoking kadm5_chpass_principal_util(). Until a patch is released, administrators should: (1) not grant delegated c/OP_CPW rights over principals marked +lockdown_keys in kadm5.acl or auth plugins; (2) restrict or disable the kpasswd set-password service (port 464) where delegated cross-principal password changes are not required; (3) monitor kadmind logs for successful setpw request entries targeting protected principals; and (4) implement network-level access controls limiting kpasswd access to trusted administrative hosts (Red Hat Bugzilla, Red Hat CVE).

The vulnerability was disclosed via the oss-security mailing list and picked up by Linux security advisory aggregators including LinuxSecurity.com and Slackware's ChangeLog. Red Hat has opened a tracking bug and assigned a Moderate severity rating, noting that exploitation depends on authenticated, policy-dependent delegated privilege and that straightforward operational mitigations exist. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (oss-sec, Red Hat Bugzilla).