Himmelblau leaks credentials in the debug log
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.
Summary
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled, user access tokens are inadvertently logged, potentially exposing sensitive authentication data. Similarly, Kerberos Ticket-Granting Tickets (TGTs) are logged when debug logging is enabled. Both issues pose a risk of exposing sensitive credentials, particularly in environments where debug logging is enabled. Himmelblau versions 0.7.15 and 0.8.3 contain a patch that fixes both issues. Some workarounds are available for users who are unable to upgrade. For the **logon compliance script issue**, disable the `logon_script` option in `/etc/himmelblau/himmelblau.conf`, and avoid using the `-d` flag when starting the `himmelblaud` daemon. For the Kerberos CCache issue, one may disable debug logging globally by setting the `debug` option in `/etc/himmelblau/himmelblau.conf` to `false` and avoiding the `-d` parameter when starting `himmelblaud`.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| himmelblau-idm | himmelblau | 0.7.0 to before 0.7.15; 0.8.0 to before 0.8.3 | 0.7.15, 0.8.3 | Patch available | CNA |
- himmelblau Vendorhimmelblau-idm Affected 0.7.0 to before 0.7.15; 0.8.0 to before 0.8.3 Fixed in 0.7.15, 0.8.3 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:* | — | — | himmelblau-idm |
- cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:* Versions — — ·himmelblau-idm
Remediation
- Fix · CNA himmelblau (himmelblau-idm) Fixed in 0.7.15, 0.8.3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-24034
References
Other 6
- https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-p989-2f5w-9cf6
- https://github.com/himmelblau-idm/himmelblau/commit/1216804f15ce5dc74bb5da48b5508c41d2ece8fa
- https://github.com/himmelblau-idm/himmelblau/releases/tag/0.7.15
- https://github.com/himmelblau-idm/himmelblau/releases/tag/0.8.3
- https://manpages.opensuse.org/Tumbleweed/himmelblau/himmelblau.conf.5.en.html
- https://manpages.opensuse.org/Tumbleweed/himmelblau/himmelblaud.8.en.html
More himmelblau-idm vulnerabilities
- TI-2026-24522 himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccache CVSS 3.1HIGH 8.8
- TI-2026-26683 himmelblau: NSS fake-primary group lookup reintroduces name collision risk CVSS 3.1HIGH 7.0
- TI-2025-34616 Himmelblau's Kerberos credential cache collection is world readable CVSS 3.1HIGH 7.1
- TI-2026-24501 Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments CVSS 3.1CRITICAL 10.0
- TI-2026-32945 Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow CVSS 3.1HIGH 8.4
- TI-2025-31140 Himmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypass CVSS 3.1MEDIUM 5.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences