CVE-2026-118380: 
Kerberos vulnerability analysis and mitigation

CVE-2026-118380 is a message integrity vulnerability in MIT Kerberos 5 (krb5) affecting release 1.4 and later, specifically in the kadmind component. An active network attacker can alter arguments sent by a legitimate client to RPC services protected by RPCSEC_GSS, or cause return values to be transmitted in plain text. The CVE was reported on 2026-10-29 and published on 2026-11-09, with a patch reference added on 2026-11-10. It carries a CVSS v3.1 base score of 7.4 (High) (Red Hat CVE, Red Hat Bugzilla).

The vulnerability is classified as CWE-924 (Improper Enforcement of Message Integrity During Transmission in a Communication Channel). The flaw resides in how MIT krb5's kadmind handles RPCSEC_GSS-protected RPC communications: an active man-in-the-middle attacker on the network can tamper with RPC request arguments before they reach the service, or manipulate the session such that response values are returned without encryption or integrity protection. Exploitation requires no authentication and no user interaction, but does require a high-complexity network position (i.e., the attacker must be actively positioned on the communication path between client and server) (Red Hat CVE, Red Hat Bugzilla).

A successful attack allows an unauthenticated network adversary to both tamper with RPC call arguments (high integrity impact) and read sensitive return values transmitted in plain text (high confidentiality impact). Since kadmind is the Kerberos administration daemon, compromised RPC integrity could allow an attacker to alter administrative operations such as principal creation, password changes, or policy modifications. Availability is not directly impacted, but the combination of data exposure and request tampering could facilitate further privilege escalation within a Kerberos-managed environment (Red Hat CVE, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The CVE status remains "Reserved" and exploitation requires a high-complexity network position (active man-in-the-middle). No threat actor attribution has been reported, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog. No EPSS score data is currently available for this CVE.

1. Positioning: Gain an active man-in-the-middle position on the network path between a legitimate Kerberos administration client and the kadmind server (e.g., via ARP spoofing, BGP hijacking, or rogue network device).
2. Traffic interception: Intercept RPCSEC_GSS-protected RPC traffic between the client and kadmind, identifying the relevant RPC request packets.
3. Argument tampering: Modify the RPC request arguments in transit before they reach kadmind, exploiting the lack of proper message integrity enforcement to alter administrative operations (e.g., changing a target principal name or policy parameter).
4. Response downgrade: Alternatively, manipulate the session negotiation or response handling to cause kadmind to return sensitive response values (e.g., Kerberos principal data) in plain text rather than encrypted form.
5. Data harvesting or privilege escalation: Read the exposed plain-text response data or observe the effects of the tampered administrative request to gather sensitive information or achieve unauthorized administrative actions within the Kerberos realm (Red Hat Bugzilla, Red Hat CVE).

• Network: Unexpected ARP cache changes or duplicate MAC addresses on segments hosting Kerberos clients or the kadmind server; anomalous routing changes near Kerberos infrastructure; unencrypted RPC traffic observed on ports used by kadmind (typically TCP 749).
• Logs: kadmind logs showing administrative operations (principal creation, password changes) not initiated by known administrators; mismatches between client-side audit logs and server-side kadmind operation logs.
• Process/Service: Unexpected plain-text RPC responses captured by network monitoring tools on kadmind communication channels; RPCSEC_GSS negotiation anomalies logged by the Kerberos service.

A patch has been made available for MIT krb5; users should update to the patched version of krb5 as referenced in the Red Hat Bugzilla tracker (Red Hat Bugzilla). As interim workarounds: apply network segmentation to restrict attacker access to the network path between Kerberos clients and kadmind; use additional transport-layer encryption (e.g., IPsec or TLS tunnels) for RPC communications beyond RPCSEC_GSS where feasible; and monitor for unexpected unencrypted RPC traffic or anomalous kadmind operations. Slackware has also issued an updated krb5 package (Linux Security).

The vulnerability was disclosed via the oss-security mailing list and picked up by Linux distribution security advisories, including Slackware and FreeBSD ports (oss-sec, Linux Security). Red Hat has tracked the issue as high severity in its Bugzilla system. No notable independent researcher commentary or significant social media discussion has been observed at this time.