PT-2026-24809 · Microsoft+1 · Intune+2

Khronosd · Published 2026-03-11 · Updated 2026-04-15 · CVE-2026-31979

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Himmelblau versions prior to 3.1.0 Himmelblau versions prior to 2.3.8

Description Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. The himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc <uid> without symlink protections. The PrivateTmp setting was removed from the daemon’s systemd hardening, exposing it to the host /tmp. A local user can exploit this through symlink attacks to overwrite arbitrary files, potentially achieving local privilege escalation. This is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability where a Kerberos cache file can be swapped for a symlink to /etc/shadow, allowing an unprivileged user to gain control of system credentials.

Recommendations Versions prior to 3.1.0: Update to version 3.1.0. Versions prior to 2.3.8: Update to version 2.3.8.

Exploit

Fix

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-31979

GHSA-44WM-Q286-GHQ3

OPENSUSE-FU-2026:20453-1

OPENSUSE-SU-2026:10328-1

SUSE-FU-2026:20990-1

SUSE-SU-2026:1361-1

Affected Products

Himmelblau

Intune

Azure Entra Id

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31979.json · Exploit
• https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-44wm-q286-ghq3 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-FU-2026:20453-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10328-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-FU-2026:20990-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31979 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31979 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1361-1 · Vendor Advisory
• https://twitter.com/CVEnew/status/2031867668597227885 · Twitter Post
• https://bugzilla.suse.com/1258236 · Note
• https://reddit.com/r/SecOpsDaily/comments/1s0nml8/from_36day_zerodays_to_vibecoded_malware_the · Reddit Post
• https://suse.com/security/cve/CVE-2026-25727 · Note
• https://suse.com/security/cve/CVE-2026-31979 · Note
• https://bugzilla.suse.com/1261324 · Note
• https://bugzilla.suse.com/1247735 · Note