CVE-2026-50192

{"id": "CVE-2026-50192", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50192", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T14:54:10.532284Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kerberos-io", "product": "agent", "versions": [{"status": "affected", "version": "< 3.6.26"}]}]}], "published": "2026-08-20T22:17:20.390", "references": [{"url": "https://github.com/kerberos-io/agent/commit/51f1a52e170f21c1264c6de1dc781d5b5e2a5d09", "source": "security-advisories@github.com"}, {"url": "https://github.com/kerberos-io/agent/security/advisories/GHSA-h5gx-45rj-2h5j", "source": "security-advisories@github.com"}, {"url": "https://github.com/kerberos-io/agent/security/advisories/GHSA-h5gx-45rj-2h5j", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` request headers to the operator-configured Hub URL (`config.HubURI`). The HTTP client used (`&http.Client{}` in `UploadKerberosHub`) is constructed without a `CheckRedirect` policy, so it follows HTTP redirects automatically. Go's `net/http` strips only sensitive headers (`Authorization`, `Cookie`, `WWW-Authenticate`) on a cross-host redirect; it does not strip custom headers such as `X-Kerberos-Hub-PrivateKey`. As a result, if the configured `HubURI` returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party. Version 3.6.26 fixes the issue by implementing the `CheckRedirect` strip plus a cross-host regression test is provided to the maintainer through the advisory's private temporary fork."}, {"lang": "es", "value": "Kerberos Agent es un agente de gesti\u00f3n de v\u00eddeo (vigilancia) de c\u00f3digo abierto. Antes de la versi\u00f3n 3.6.26, la ruta de carga de Kerberos Hub env\u00eda las credenciales del Hub del agente en los encabezados de solicitud personalizados 'X-Kerberos-Hub-PrivateKey' y 'X-Kerberos-Hub-PublicKey' a la URL del Hub configurada por el operador ('config.HubURI'). El cliente HTTP utilizado ('&http.Client{}' en 'UploadKerberosHub') se construye sin una pol\u00edtica de 'CheckRedirect', por lo que sigue las redirecciones HTTP autom\u00e1ticamente. El 'net/http' de Go elimina solo los encabezados sensibles ('Authorization', 'Cookie', 'WWW-Authenticate') en una redirecci\u00f3n entre hosts; no elimina encabezados personalizados como 'X-Kerberos-Hub-PrivateKey'. Como resultado, si la 'HubURI' configurada devuelve una redirecci\u00f3n 30x entre hosts, la clave privada del Hub se reenv\u00eda textualmente al destino de la redirecci\u00f3n, divulgando la credencial a un tercero no deseado. La versi\u00f3n 3.6.26 soluciona el problema mediante la implementaci\u00f3n de la eliminaci\u00f3n de 'CheckRedirect', adem\u00e1s de proporcionar una prueba de regresi\u00f3n entre hosts al mantenedor a trav\u00e9s del fork temporal privado del aviso."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security-advisories@github.com"}