Read the docs
TI-2025-34536 Aliases CVE-2025-54781

Himmelblau leaks an Intune service access token in its logs

Priority LOW 13CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau in version 1.0.0, the himmelblaud_tasks service leaks an Intune service access token to the system journal. This short-lived token can be used to detect the host's Intune compliance status, and may permit additional administrative operations for the Intune host device (though the API for these operations is undocumented). This is fixed in version 1.1.0. To workaround this issue, ensure that Himmelblau debugging is disabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00164 5th percentileScored 2026-11-07
Fix Fixed himmelblau (himmelblau-idm): 1.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
himmelblau-idmhimmelblau1.0.0 to before 1.1.01.1.0Patch availableCNA
  • himmelblau Vendorhimmelblau-idm Affected 1.0.0 to before 1.1.0 Fixed in 1.1.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*——himmelblau-idm
  • cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:* Versions — — ·himmelblau-idm

Remediation

  • Fix · CNA himmelblau (himmelblau-idm) Fixed in 1.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54781

References

Other 3

  • TI-2026-24522 himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccache CVSS 3.1HIGH 8.8
  • TI-2026-26683 himmelblau: NSS fake-primary group lookup reintroduces name collision risk CVSS 3.1HIGH 7.0
  • TI-2025-34616 Himmelblau's Kerberos credential cache collection is world readable CVSS 3.1HIGH 7.1
  • TI-2026-24501 Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments CVSS 3.1CRITICAL 10.0
  • TI-2026-32945 Himmelblau: Authentication Bypass via Cross-User Local Session Impersonation in Device Authorization Grant (DAG) Flow CVSS 3.1HIGH 8.4
  • TI-2025-31140 Himmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypass CVSS 3.1MEDIUM 5.4
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences