CVE-2026-31979: Himmelblau Privilege Escalation Vulnerability

CVE-2026-31979 Overview

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A local privilege escalation vulnerability exists in the himmelblaud-tasks daemon, which runs as root and writes Kerberos cache files to /tmp/krb5cc_<uid> without proper symlink protections. Since commit 87a51ee, the PrivateTmp systemd hardening option was explicitly removed from the tasks daemon, exposing it to the host /tmp directory. This allows local users to exploit the vulnerability via symlink attacks to change ownership (chown) or overwrite arbitrary files, ultimately achieving local privilege escalation.

Critical Impact

Local attackers can leverage symlink attacks against the himmelblaud-tasks daemon to escalate privileges to root by manipulating Kerberos cache file operations in the shared /tmp directory.

Affected Products

• Himmelblau versions prior to 3.1.0
• Himmelblau versions prior to 2.3.8
• Systems running himmelblaud-tasks daemon with Azure Entra ID/Intune integration

Discovery Timeline

• 2026-03-11 - CVE CVE-2026-31979 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-31979

Vulnerability Analysis

This vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access), commonly known as a symlink attack. The himmelblaud-tasks daemon operates with root privileges and performs file operations in the world-writable /tmp directory without verifying whether target paths are symbolic links.

The critical security regression occurred when the PrivateTmp systemd hardening feature was explicitly removed in commit 87a51ee. This hardening option normally provides each systemd service with its own private /tmp namespace, isolating it from other processes and users. By removing this protection, the daemon now shares the host system's /tmp directory with all other processes, creating an exploitable race condition.

When the daemon writes Kerberos cache files to /tmp/krb5cc_<uid>, an attacker can race to create a symbolic link at that path pointing to a sensitive system file. When the root-privileged daemon subsequently writes to or changes ownership of the file, the operation follows the symlink and affects the attacker-chosen target instead.

Root Cause

The root cause is twofold: (1) the explicit removal of PrivateTmp=true from the systemd service configuration, and (2) the absence of symlink-safe file operations (such as using O_NOFOLLOW flags or atomic file creation with mkstemp()) when handling Kerberos cache files in shared directories. The combination allows predictable file paths to be exploited by local users.

Attack Vector

The attack requires local access to the system. An attacker can predict the Kerberos cache file path based on user IDs and create a symbolic link before the daemon writes the file. The attack scenario follows a Time-of-Check Time-of-Use (TOCTOU) pattern:

1. Attacker identifies the target UID and predicts the cache file path (/tmp/krb5cc_<uid>)
2. Attacker creates a symbolic link at the target path pointing to a sensitive file (e.g., /etc/passwd, /etc/shadow, or SSH authorized_keys)
3. When himmelblaud-tasks daemon writes the Kerberos cache or changes file ownership, the operation follows the symlink
4. The attacker gains the ability to overwrite or modify ownership of arbitrary files, leading to privilege escalation

The exploitation does not require user interaction and can be performed by any local user with access to /tmp.

Detection Methods for CVE-2026-31979

Indicators of Compromise

• Unexpected symbolic links in /tmp pointing to sensitive system files (e.g., /tmp/krb5cc_* pointing to /etc/shadow)
• Abnormal file permission or ownership changes on critical system files such as /etc/passwd, /etc/shadow, or SSH configuration files
• Suspicious process activity involving the himmelblaud-tasks daemon with unexpected file operations
• Audit logs showing file operations by root on sensitive files initiated through /tmp paths

Detection Strategies

• Implement file integrity monitoring (FIM) on critical system files to detect unauthorized modifications
• Monitor /tmp directory for creation of symbolic links with names matching krb5cc_* patterns
• Enable Linux auditd rules to track symlink creation and file operations by the himmelblaud-tasks process
• Review systemd service configurations for services running without PrivateTmp hardening

Monitoring Recommendations

• Configure SIEM rules to alert on ownership changes to sensitive files like /etc/passwd, /etc/shadow, and SSH authorized_keys files
• Monitor process behavior of himmelblaud-tasks daemon for file operations outside expected directories
• Implement real-time symlink monitoring in /tmp for files matching Kerberos cache naming patterns

How to Mitigate CVE-2026-31979

Immediate Actions Required

• Upgrade Himmelblau to version 3.1.0 or 2.3.8 immediately to address the vulnerability
• If immediate patching is not possible, manually re-enable PrivateTmp=true in the himmelblaud-tasks systemd service unit file
• Audit systems for any signs of exploitation, including unexpected file ownership changes or suspicious symbolic links in /tmp
• Restrict local user access where feasible to reduce the attack surface

Patch Information

This vulnerability is fixed in Himmelblau versions 3.1.0 and 2.3.8. The fix restores proper symlink protections and systemd hardening. For detailed patch information and release notes, refer to the GitHub Security Advisory.

Workarounds

• Manually add PrivateTmp=true to the himmelblaud-tasks.service systemd unit file as a temporary mitigation
• Create a drop-in override file for the systemd service to restore the hardening option
• Consider mounting /tmp with nosuid and nodev options to reduce exploitation impact
• Implement additional access controls using SELinux or AppArmor policies to restrict the daemon's file access

# Configuration example - Re-enable PrivateTmp hardening
sudo mkdir -p /etc/systemd/system/himmelblaud-tasks.service.d/
cat << EOF | sudo tee /etc/systemd/system/himmelblaud-tasks.service.d/hardening.conf
[Service]
PrivateTmp=true
EOF
sudo systemctl daemon-reload
sudo systemctl restart himmelblaud-tasks