CVE-2026-31979
High
Description
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulnerability is fixed in 3.1.0 and 2.3.8.
SeverityHigh
CVSS8.8
Exploit probability—
ProductHimmelblau
PublishedMar 11, 2026
First seenMar 11, 2026
Weakness typeCWE-59Improper link resolution
How to fix
Update
- himmelblau-idm himmelblau2.3.8, 3.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| himmelblau-idm himmelblau | 1.0.0 ≤ v < 2.3.8, 3.0.0 ≤ v < 3.1.0 | 2.3.8, 3.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.