Read the docs
TI-2026-26683 Aliases CVE-2026-34397

himmelblau: NSS fake-primary group lookup reintroduces name collision risk

Priority HIGH 66CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.

Summary

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., "sudo", "wheel", "docker", "adm") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00164 5th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed himmelblau (himmelblau-idm): 2.3.9, 3.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
himmelblau-idmhimmelblau2.0.0-alpha to before 2.3.9; 3.0.0-alpha to before 3.1.12.3.9, 3.1.1Patch availableCNA
  • himmelblau Vendorhimmelblau-idm Affected 2.0.0-alpha to before 2.3.9; 3.0.0-alpha to before 3.1.1 Fixed in 2.3.9, 3.1.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:*2.0.0 to before 2.3.9; 3.0.0 to before 3.1.1Vulnerablehimmelblau-idm
  • cpe:2.3:a:himmelblau-idm:himmelblau:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.3.9; 3.0.0 to before 3.1.1 Vulnerable ·himmelblau-idm

Remediation

  • Fix · CNA himmelblau (himmelblau-idm) Fixed in 2.3.9, 3.1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34397

References

Exploit 1

Other 2

  • TI-2026-24522 himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccache CVSS 3.1HIGH 8.8
  • TI-2025-34616 Himmelblau's Kerberos credential cache collection is world readable CVSS 3.1HIGH 7.1
  • TI-2026-24501 Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments CVSS 3.1CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences