Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulnerability is fixed in 3.1.0 and 2.3.8.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-11 | 2 | Disclosure1Patch1 |
| 2026-03-20 | 1 | Patch1 |
| 2026-03-23 | 1 | Disclosure1 |
| 2026-04-24 | 1 | Disclosure1 |
CVE-2026-31979 the symlink trap root privilege escalation in Himmelblau -- https://www.akamai.com/blog/security-research/cve-2026-31979-symlink-root-privilege-escalation-himmelblau
Post summary
A new root‑privilege escalation flaw (symlink trap) in Himmelblau has been disclosed via an Akamai blog post, but no exploit code, active attacks, or patches are cited.
[CVE-2026-31979: HIGH] Himmelblau security vulnerability fixed in version 3.1.0 and 2.3.8. Root daemon exposed to symlink attacks, allowing local privilege escalation on Microsoft Azure Entra ID and Intune.#cve,CVE-2026-31979,#cybersecurity https://cvefind.com/CVE-2026-31979
Post summary
The post announces that CVE-2026-31979, a high‑severity privilege‑escalation flaw in the Himmelblau root daemon, has been patched in versions 3.1.0 and 2.3.8.
Akamai 最新ブログ：CVE-2026-31979：シンボリックリンクの罠 — Himmelblau における root 権限の昇格 深刻度の高い脆弱性である CVE-2026-31979 は、特定の Himmelblau の導入環境に影響を及ぼします。直ちに対策を講じることをお勧めします。 詳しくはこちら▼ https://ow.ly/o3wY50YKKog
Post summary
A blog post discloses CVE-2026-31979, a high‑severity root‑privilege escalation vulnerability triggered by a symbolic link trap in Himmelblau environments, and urges immediate remediation.
🚨 Critical Update: Root Escalation in Himmelblau (CVE-2026-31979) Akamai’s latest research confirms a Root Privilege Escalation in the Himmelblau identity suite. The Technical Hook: A classic TOCTOU (Time-of-Check to Time-of-Use) symlink race. By swapping a Kerberos cache file for a symlink to /etc/shadow, an unprivileged user can seize control of system credentials. The Fix: Update to v3.1.0 immediately. This version restores critical PrivateTmp systemd hardening, isolating the service from host-level symlink attacks. Why it matters: In managed environments, a single compromised node can expose the entire fleet's identity infrastructure. Full Analysis: https://www.akamai.com/blog/security-research/cve-2026-31979-symlink-root-privilege-escalation-himmelblau #CyberSecurity #ThreatHunting #LinuxSecurity #Akamai #CloudSecurity
Post summary
The announcement focuses on a critical root privilege escalation in the Himmelblau suite, providing a detailed vulnerability description and an immediate patch recommendation.
CVE-2026-31979 Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerbe… https://www.cve.org/CVERecord?id=CVE-2026-31979
Post summary
A new CVE-2026-31979 vulnerability is disclosed for Himmelblau, affecting versions before 3.1.0 and 2.3.8; the flaw involves the himmelblaud‑tasks daemon running as root writing Kerberos data, with newer releases presumably patching the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | himmelblau-idm | himmelblau | - | - | - |