Read the docs
TI-2025-34616 Aliases CVE-2025-54882

Himmelblau's Kerberos credential cache collection is world readable

Priority HIGH 66CWE-522Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00234 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed himmelblau (himmelblau-idm): 0.9.22, 1.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
himmelblau-idmhimmelblau0.8.0 to before 0.9.22; 1.0.0-beta to before 1.2.00.9.22, 1.2.0Patch availableCNA
  • himmelblau Vendorhimmelblau-idm Affected 0.8.0 to before 0.9.22; 1.0.0-beta to before 1.2.0 Fixed in 0.9.22, 1.2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*0.8.0 to before 0.9.22; 1.0.0 to before 1.2.0Vulnerablehimmelblau-idm
  • cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:* Versions 0.8.0 to before 0.9.22; 1.0.0 to before 1.2.0 Vulnerable ·himmelblau-idm

Remediation

  • Fix · CNA himmelblau (himmelblau-idm) Fixed in 0.9.22, 1.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54882

References

Exploit 1

Patch 2

Other 2

  • TI-2026-24522 himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccache CVSS 3.1HIGH 8.8
  • TI-2026-26683 himmelblau: NSS fake-primary group lookup reintroduces name collision risk CVSS 3.1HIGH 7.0
  • TI-2026-24501 Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments CVSS 3.1CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences