CVE-2026-111423: 
Kerberos vulnerability analysis and mitigation

CVE-2026-111423 is a PAC checksum verification bypass vulnerability in MIT Kerberos 5 (krb5) affecting release 1.21 and later. In affected versions, server applications erroneously treat the Privilege Attribute Certificate (PAC) within a Kerberos ticket as verified even when the server checksum is invalid, leading to improper authorization decisions. The vulnerability was reported on 2026-05-18 and published on 2026-11-09, with a CVE status of Reserved. It carries a CVSS v3.1 base score of 4.2 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-354 (Improper Validation of Integrity Check Value). In verify_pac_checksums() within src/lib/krb5/krb/pac.c, the server checksum verification result is stored in ret, but execution does not immediately exit on failure — control falls through to pac->verified = TRUE before returning the non-zero error code. The mspac_verify() function subsequently calls krb5_pac_verify() with privsvr == NULL, logs the error, but intentionally returns success (0). Downstream, mspac_get_attribute() uses pac->verified to set the authenticated result, meaning an invalid PAC can be surfaced to consumers as authenticated. Exploitation requires the attacker to be an authenticated low-privileged Kerberos principal capable of presenting crafted PAC-bearing tickets through the mspac AP-REQ verification path (Red Hat Bugzilla).

Successful exploitation allows an authenticated attacker with low privileges to bypass PAC verification, causing downstream mspac consumers to treat unverified PAC data as authenticated. This can result in unauthorized access to resources or privilege escalation in deployments where PAC-derived identity or authorization attributes influence security decisions. Confidentiality and integrity impacts are both rated Low; there is no demonstrated availability impact, and the flaw does not constitute a general Kerberos authentication bypass (Red Hat Bugzilla, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat Advisory). Exploitation requires high attack complexity — the attacker must cause a server-checksum verification failure while hitting the specific code path that ignores the returned error, and must be an authenticated low-privileged Kerberos principal. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score or threat actor attribution is currently available.

1. Authenticate as a low-privileged Kerberos principal: Obtain valid Kerberos credentials for a low-privileged account in the target realm to participate in Kerberos exchanges.
2. Craft or mutate a PAC: Create or modify a Kerberos ticket so that the KRB5_PAC_SERVER_CHECKSUM field is invalid (e.g., corrupted or replaced with an incorrect checksum value).
3. Inject the crafted ticket into AP-REQ processing: Present the PAC-bearing ticket to a vulnerable server application that uses the mspac_import_authdata path, triggering mspac_verify() to call krb5_pac_verify() with privsvr == NULL.
4. Trigger the verification state confusion: Observe that krb5_pac_verify() returns a non-zero error (checksum failure) but still sets pac->verified = TRUE before returning; mspac_verify() logs the error but returns 0 (success).
5. Exploit downstream trust: Query an mspac attribute (e.g., urn:mspac:logon-info) via mspac_get_attribute(); the authenticated output is reported as TRUE despite the failed checksum, allowing the attacker to have PAC-derived identity or authorization attributes accepted as verified by the server application (Red Hat Bugzilla).

The proposed fix is to add an early exit (goto cleanup) in verify_pac_checksums() immediately after a failed server checksum verification, preventing pac->verified from being set to TRUE on an error path. Administrators should upgrade MIT krb5 to a patched version once released, and apply the fix referenced in Red Hat Bugzilla ID 2479394 for their distribution. As a workaround until a patch is available, applications consuming mspac-exported PAC data should not treat the authenticated result as authoritative if PAC verification produced an error — fail closed on PAC verification failure rather than trusting the library state. Environments should audit any access decisions made through Kerberos authentication where PAC attributes influence authorization (Red Hat Bugzilla, Red Hat Advisory).

The vulnerability was disclosed via the oss-security mailing list and picked up by Linux distribution security trackers including Slackware and FreeBSD ports (Red Hat Advisory). Red Hat has classified the issue as Moderate severity, noting it does not meet criteria for Important or Critical due to the deployment-dependent nature of exploitation and the absence of a general authentication bypass. No significant broader media coverage or notable researcher commentary has been identified at this time.