CVE-2026-57915: Apache Kerby Auth Bypass Vulnerability

CVE-2026-57915 Overview

CVE-2026-57915 is a Kerberos pre-authentication bypass vulnerability in Apache Kerby. Attackers can bypass the pre-authentication check by sending a PA-DATA element with an unrecognized or unsupported type. The Kerby Key Distribution Center (KDC) accepts the request as valid despite failing to properly validate the pre-authentication data. Apache has released version 2.1.2 to remediate the flaw. The vulnerability is classified under [CWE-304] Missing Critical Step in Authentication and [CWE-358] Improperly Implemented Security Check for Standard.

Critical Impact
Remote unauthenticated attackers can bypass Kerberos pre-authentication, weakening authentication guarantees and enabling further attacks against principals served by the KDC.

Affected Products

Apache Kerby versions prior to 2.1.2
Applications and services embedding Apache Kerby as their KDC or Kerberos library
Downstream distributions repackaging Apache Kerby (see Red Hat CVE-2026-57915 Details)

Discovery Timeline

2026-06-26 - CVE CVE-2026-57915 published to NVD
2026-06-26 - Disclosure announced on the Openwall OSS-Security Announcement and Apache Mailing List Thread
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-57915

Vulnerability Analysis

Apache Kerby is a Java-based Kerberos 5 implementation providing both client and KDC functionality. Kerberos pre-authentication requires the client to prove possession of the principal's long-term key before the KDC issues a Ticket Granting Ticket (TGT). The client submits pre-authentication data inside one or more PA-DATA structures within the AS-REQ message.

In vulnerable versions of Kerby, the KDC iterates over incoming PA-DATA entries and evaluates whether pre-authentication succeeded. When a PA-DATA element carries an unrecognized or unsupported padata-type, the server does not treat the request as unauthenticated. It instead accepts the request path as if pre-authentication had been performed, allowing an attacker to bypass this control entirely.

The EPSS score for this issue is 0.321% (percentile 23.958), reflecting current probabilistic exploitation likelihood rather than technical impact.

Root Cause

The root cause is an improperly implemented security check ([CWE-358]) combined with a missing critical authentication step ([CWE-304]). The KDC pre-authentication handler fails to enforce a default-deny outcome when no supported PA-DATA type is processed. A request containing only unknown padata-type values passes validation instead of being rejected.

Attack Vector

An unauthenticated remote attacker crafts an AS-REQ message directed at a Kerby KDC. The message includes a PA-DATA element whose padata-type value is not recognized or not supported by the server implementation. The KDC processes the request without failing the pre-authentication check, effectively skipping cryptographic proof of principal ownership. This lowers the barrier for downstream attacks such as offline analysis of KDC responses, credential-related probing, and unauthorized ticket workflows against principals hosted by the affected realm.

No verified public proof-of-concept code is available. See the Apache Mailing List Thread and Red Hat Bug Report #2493407 for further protocol-level detail.

Detection Methods for CVE-2026-57915

Indicators of Compromise

AS-REQ messages to the KDC containing PA-DATA entries with padata-type values outside the set defined in RFC 4120 and vendor extensions.
Successful authentication events for principals that lack a corresponding PA-ENC-TIMESTAMP or PA-PK-AS-REQ transaction in KDC logs.
Anomalous TGT issuance from source addresses that have not previously interacted with the realm.

Detection Strategies

Inspect KDC audit logs for pre-authentication decisions and correlate accepted requests with the specific padata-type values processed.
Deploy network detection on TCP/UDP port 88 to parse Kerberos ASN.1 structures and flag unusual padata-type identifiers.
Compare running Kerby library versions across hosts against version 2.1.2 using software inventory tooling.

Monitoring Recommendations

Forward KDC and application authentication logs into a centralized analytics platform for cross-realm correlation.
Alert on TGT issuance rates that deviate from historical baselines per principal and per source subnet.
Track failed and succeeded AS-REQ ratios; a sudden decline in pre-authentication failures may indicate exploitation attempts.

How to Mitigate CVE-2026-57915

Immediate Actions Required

Upgrade Apache Kerby to version 2.1.2 or later across all KDC and client deployments.
Inventory Java applications and appliances that embed Kerby libraries and prioritize patching for internet-exposed KDCs.
Rotate long-term keys for principals in realms served by vulnerable KDCs after patching, especially service principals.

Patch Information

The Apache Kerby project fixed this issue in version 2.1.2. Users are recommended to upgrade to that release, which enforces rejection of AS-REQ messages that do not include a supported PA-DATA type. Distribution-specific patches and status information are tracked in the Red Hat CSAF VEX for CVE-2026-57915.

Workarounds

Restrict network access to the KDC (port 88) to trusted client subnets using firewall rules where operationally feasible.
Require additional pre-authentication mechanisms such as PKINIT or FAST armoring for sensitive principals to raise the exploitation bar until patching is complete.
Disable exposure of the Kerby KDC to untrusted networks and route Kerberos traffic through authenticated VPN or zero-trust gateways.

bash

# Verify installed Apache Kerby version
mvn dependency:tree | grep kerby
# Expected: org.apache.kerby:*:2.1.2 or later