CVE-2026-50192

Received Received - Intake

Information Disclosure in Kerberos Agent

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` request headers to the operator-configured Hub URL (`config.HubURI`). The HTTP client used (`&http.Client{}` in `UploadKerberosHub`) is constructed without a `CheckRedirect` policy, so it follows HTTP redirects automatically. Go's `net/http` strips only sensitive headers (`Authorization`, `Cookie`, `WWW-Authenticate`) on a cross-host redirect; it does not strip custom headers such as `X-Kerberos-Hub-PrivateKey`. As a result, if the configured `HubURI` returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party. Version 3.6.26 fixes the issue by implementing the `CheckRedirect` strip plus a cross-host regression test is provided to the maintainer through the advisory's private temporary fork.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-50192

Affected Vendors & Products

Vendor	Product	Version / Range
kerberos	agent	to 3.6.26 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Kerberos Agent, an open-source video management system. In versions before 3.6.26, the agent sends its Hub credentials in custom HTTP headers during uploads. The HTTP client follows redirects automatically without stripping sensitive headers. If a redirect occurs to an unintended server, the private key is exposed to that third party.

Detection Guidance

To detect this vulnerability, inspect network traffic for HTTP requests containing the custom headers X-Kerberos-Hub-PrivateKey or X-Kerberos-Hub-PublicKey being sent to unexpected destinations due to redirects. Check Kerberos Agent logs for any 30x redirects from the configured HubURI.

Impact Analysis

An attacker could intercept the private key via a malicious redirect, gaining unauthorized access to the Kerberos Hub. This could allow them to view or manipulate surveillance footage, compromise system integrity, or impersonate the agent in future communications.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of credentials used for authentication with a Kerberos Hub service. If exploited, it may result in unauthorized access to sensitive data, potentially violating confidentiality requirements under GDPR and HIPAA. The exposure of credentials through HTTP headers during redirects could be considered a data breach under these regulations.

Mitigation Strategies

Immediately upgrade Kerberos Agent to version 3.6.26 or later to address the credential leakage issue. If upgrading is not possible, disable the Kerberos Hub upload feature or restrict the HubURI to trusted endpoints to prevent cross-host redirects.

Hi! I’m here to help you understand CVE-2026-50192. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70