{"id":"CVE-2026-57915","state":"PUBLISHED","title":"Apache Kerby: Kerberos Pre-Authentication Bypass","description":"It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.","publishedAt":"2026-06-26T12:09:54.850Z","updatedAt":"2026-08-03T12:05:45.937Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache Kerby"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Kerby","packageName":"org.apache.kerby:kerb-server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.1.2","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":["https://lists.apache.org/thread/1y3glgh3kzwoxo5m2lq504cjlh1dsrfh","http://www.openwall.com/lists/oss-security/2026/06/26/8","https://access.redhat.com/security/cve/CVE-2026-57915","https://bugzilla.redhat.com/show_bug.cgi?id=2493407","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57915.json"],"weaknesses":["CWE-304","CWE-358"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/57xxx/CVE-2026-57915.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-57915","state":"PUBLISHED","datePublished":"2026-06-26T12:09:54.850Z","dateUpdated":"2026-08-03T12:05:45.937Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2026-06-26T10:43:45.288Z"},"containers":{"cna":{"title":"Apache Kerby: Kerberos Pre-Authentication Bypass","descriptions":[{"lang":"en","value":"It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Kerby","packageName":"org.apache.kerby:kerb-server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.1.2","versionType":"semver"}],"collectionURL":"https://repo.maven.apache.org/maven2"}],"references":[{"url":"https://lists.apache.org/thread/1y3glgh3kzwoxo5m2lq504cjlh1dsrfh","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"important"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-304","description":"CWE-304 Missing Critical Step in Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-06-26T12:09:54.850Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-06-26T14:38:18.962338Z","id":"CVE-2026-57915","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-26T14:38:22.809Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/06/26/8"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-06-26T18:36:17.839Z"}},{"title":"Apache Kerby: org.apache.kerby/kerb-server: Apache Kerby: Kerberos pre-authentication bypass via unrecognized PA-DATA","descriptions":[{"lang":"en","value":"A flaw was found in Apache Kerby. An attacker can bypass the Kerberos pre-authentication check by sending a Pre-Authentication Data (PA-DATA) packet with an unrecognized or unsupported type. This vulnerability allows an attacker to circumvent the initial authentication step, potentially leading to unauthorized access or impersonation within a Kerberos-protected environment."}],"affected":[{"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"kerb-server","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_clients:2023"]},{"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"kerb-server","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"]},{"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"kerb-server-api-all","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"]},{"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"kerb-server","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"kerb-server","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"kerb-server-api-all","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"]},{"vendor":"Red Hat","product":"streams for Apache Kafka 2","packageName":"kerb-server","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:2"]},{"vendor":"Red Hat","product":"streams for Apache Kafka 3","packageName":"kerb-server","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:amq_streams:3"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-57915","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493407","name":"RHBZ#2493407","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-57915.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-358","description":"Improperly Implemented Security Check for Standard","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-08-03T12:05:45.937Z"},"datePublic":"2026-06-26T12:09:54.850Z","timeline":[{"lang":"en","time":"2026-06-26T13:00:52.106Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-06-26T12:09:54.850Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}