Description
A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD).
To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it.
The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Windows Server 2019 | 10.0.0 – < 10.0.17763.2061 | 10.0.17763.2061 |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.0 – < 10.0.17763.2061 | 10.0.17763.2061 |
| Microsoft | Windows Server, version 1909 (Server Core installation) | 10.0.0 – < publication | publication |
| Microsoft | Windows Server, version 1903 (Server Core installation) | 10.0.0 – < publication | publication |
| Microsoft | Windows Server version 2004 | 10.0.0 – < 10.0.19041.1110 | 10.0.19041.1110 |
| Microsoft | Windows Server 2016 | 10.0.0 – < 10.0.14393.4530 | 10.0.14393.4530 |
| Microsoft | Windows Server 2016 (Server Core installation) | 10.0.0 – < 10.0.14393.4530 | 10.0.14393.4530 |
| Microsoft | Windows Server 2008 Service Pack 2 | 6.0.0 – < 6.0.6003.21167 | 6.0.6003.21167 |
| Microsoft | Windows Server 2008 Service Pack 2 (Server Core installation) | 6.0.0 – < 6.0.6003.21167 | 6.0.6003.21167 |
| Microsoft | Windows Server 2008 Service Pack 2 | 6.0.0 – < 6.0.6003.21167 | 6.0.6003.21167 |
| Microsoft | Windows Server 2008 R2 Service Pack 1 | 6.1.0 – < 6.1.7601.25661 | 6.1.7601.25661 |
| Microsoft | Windows Server 2008 R2 Service Pack 1 (Server Core installation) | 6.0.0 – < 6.1.7601.25661 | 6.1.7601.25661 |
| Microsoft | Windows Server 2012 | 6.2.0 – < 6.2.9200.23409 | 6.2.9200.23409 |
| Microsoft | Windows Server 2012 (Server Core installation) | 6.2.0 – < 6.2.9200.23409 | 6.2.9200.23409 |
| Microsoft | Windows Server 2012 R2 | 6.3.0 – < 6.3.9600.20069 | 6.3.9600.20069 |
| Microsoft | Windows Server 2012 R2 (Server Core installation) | 6.3.0 – < 6.3.9600.20069 | 6.3.9600.20069 |
| Microsoft | Windows Server version 20H2 | 10.0.0 – < 10.0.19041.1110 | 10.0.19041.1110 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | krb5 +7 | 1.20.1-8.el9 | RHSA-2023:2570 |
| RHEL 8 | bind-dyndb-ldap | 11.6-4.module+el8.9.0+18911+94941f82 | RHSA-2024:0143 |
| RHEL 8 | custodia +1 | 0.6.0-3.module+el8.9.0+18911+94941f82 | RHSA-2024:0143 |
| RHEL 8 | ipa +15 | 4.9.12-11.module+el8.9.0+20824+f2605038 | RHSA-2024:0143 |
| RHEL 8 | ipa-healthcheck +1 | 0.12-3.module+el8.9.0+19634+c162f948 | RHSA-2024:0143 |
| RHEL 8 | opendnssec | 2.1.7-1.module+el8.9.0+18911+94941f82 | RHSA-2024:0143 |
| RHEL 8 | python-jwcrypto +1 | 0.5.0-1.1.module+el8.9.0+18911+94941f82 | RHSA-2024:0143 |
| RHEL 8 | python-kdcproxy +1 | 0.4-5.module+el8.9.0+18911+94941f82 | RHSA-2024:0143 |
| RHEL 8 | python-qrcode +2 | 5.1-12.module+el8.9.0+18911+94941f82 | RHSA-2024:0143 |
| RHEL 8 | python-yubico +1 | 1.3.2-9.1.module+el8.9.0+18911+94941f82 | RHSA-2024:0143 |
| RHEL 8 | pyusb +1 | 1.0.0-9.1.module+el8.9.0+18911+94941f82 | RHSA-2024:0143 |
| RHEL 8 | slapi-nis | 0.60.0-4.module+el8.9.0+20420+fef9eb45 | RHSA-2024:0143 |
| RHEL 8 | softhsm +1 | 2.6.0-5.module+el8.9.0+18911+94941f82 | RHSA-2024:0143 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.8 EUS | bind-dyndb-ldap | 11.6-4.module+el8.8.0+17351+9a3fb056 | RHSA-2024:0137 |
| RHEL 8.8 EUS | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2024:0137 |
| RHEL 8.8 EUS | ipa +15 | 4.9.11-9.module+el8.8.0+20825+52dd1628 | RHSA-2024:0137 |
| RHEL 8.8 EUS | ipa-healthcheck +1 | 0.12-1.module+el8.8.0+17582+6bf5bf91 | RHSA-2024:0137 |
| RHEL 8.8 EUS | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2024:0137 |
| RHEL 8.8 EUS | python-jwcrypto +1 | 0.5.0-1.1.module+el8.7.0+15842+306cbc83 | RHSA-2024:0137 |
| RHEL 8.8 EUS | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2024:0137 |
| RHEL 8.8 EUS | python-qrcode +2 | 5.1-12.module+el8.1.0+4098+f286395e | RHSA-2024:0137 |
| RHEL 8.8 EUS | python-yubico +1 | 1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2024:0137 |
| RHEL 8.8 EUS | pyusb +1 | 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2024:0137 |
| RHEL 8.8 EUS | slapi-nis | 0.60.0-4.module+el8.8.0+20635+330e3683 | RHSA-2024:0137 |
| RHEL 8.8 EUS | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2024:0137 |
| RHEL 8.6 EUS | bind-dyndb-ldap | 11.6-4.module+el8.6.0+16878+6c033536 | RHSA-2024:0139 |
| RHEL 8.6 EUS | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2024:0139 |
| RHEL 8.6 EUS | ipa +15 | 4.9.8-11.module+el8.6.0+20984+095e5c46 | RHSA-2024:0139 |
| RHEL 8.6 EUS | ipa-healthcheck +1 | 0.7-10.module+el8.6.0+14292+18b36d36 | RHSA-2024:0139 |
| RHEL 8.6 EUS | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2024:0139 |
| RHEL 8.6 EUS | python-jwcrypto +1 | 0.5.0-1.module+el8.1.0+4098+f286395e | RHSA-2024:0139 |
| RHEL 8.6 EUS | python-kdcproxy +1 | 0.4-5.module+el8.2.0+4691+a05b2456 | RHSA-2024:0139 |
| RHEL 8.6 EUS | python-qrcode +2 | 5.1-12.module+el8.1.0+4098+f286395e | RHSA-2024:0139 |
| RHEL 8.6 EUS | python-yubico +1 | 1.3.2-9.module+el8.1.0+4098+f286395e | RHSA-2024:0139 |
| RHEL 8.6 EUS | pyusb +1 | 1.0.0-9.module+el8.1.0+4098+f286395e | RHSA-2024:0139 |
| RHEL 8.6 EUS | slapi-nis | 0.60.0-1.module+el8.6.0+16878+6c033536 | RHSA-2024:0139 |
| RHEL 8.6 EUS | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2024:0139 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | libkadm5 +6 | 1.20.1-8.el9 | ALSA-2023:2570 |
| AlmaLinux 8 | bind-dyndb-ldap | 11.6-4.module_el8.6.0+3339+9b5fdd22 | ALSA-2024:0143 |
| AlmaLinux 8 | custodia +1 | 0.6.0-3.module_el8.6.0+2881+2f24dc92 | ALSA-2024:0143 |
| AlmaLinux 8 | ipa-client +14 | 4.9.12-11.module_el8.9.0+3715+e4197dc9.alma.1 | ALSA-2024:0143 |
| AlmaLinux 8 | ipa-healthcheck +1 | 0.12-3.module_el8.9.0+3651+d05ea4c5 | ALSA-2024:0143 |
| AlmaLinux 8 | opendnssec | 2.1.7-1.module_el8.6.0+2881+2f24dc92 | ALSA-2024:0143 |
| AlmaLinux 8 | python3-jwcrypto | 0.5.0-1.1.module_el8.7.0+3349+cfeff52e | ALSA-2024:0143 |
| AlmaLinux 8 | python3-kdcproxy | 0.4-5.module_el8.9.0+3682+f63caf3e | ALSA-2024:0143 |
| AlmaLinux 8 | python3-pyusb | 1.0.0-9.1.module_el8.7.0+3349+cfeff52e | ALSA-2024:0143 |
| AlmaLinux 8 | python3-qrcode +1 | 5.1-12.module_el8.6.0+2881+2f24dc92 | ALSA-2024:0143 |
| AlmaLinux 8 | python3-yubico | 1.3.2-9.1.module_el8.7.0+3349+cfeff52e | ALSA-2024:0143 |
| AlmaLinux 8 | slapi-nis | 0.60.0-4.module_el8.9.0+3682+f63caf3e.alma.1 | ALSA-2024:0143 |
| AlmaLinux 8 | softhsm +1 | 2.6.0-5.module_el8.6.0+2881+2f24dc92 | ALSA-2024:0143 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | custodia | 0.6.0-3.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:0143 |
| Rocky Linux 8 | ipa-healthcheck | 0.12-3.module+el8.9.0+1433+5bd2f890 | RLSA-2024:0143 |
| Rocky Linux 8 | opendnssec | 2.1.7-1.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:0143 |
| Rocky Linux 8 | python-kdcproxy | 0.4-5.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:0143 |
| Rocky Linux 8 | python-qrcode | 5.1-12.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:0143 |
| Rocky Linux 8 | python-yubico | 1.3.2-9.1.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:0143 |
| Rocky Linux 8 | pyusb | 1.0.0-9.1.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:0143 |
| Rocky Linux 8 | slapi-nis | 0.60.0-4.module+el8.9.0+1573+39ab85f4 | RLSA-2024:0143 |
| Rocky Linux 8 | softhsm | 2.6.0-5.module+el8.9.0+1371+ffa84eb9 | RLSA-2024:0143 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 7 | ldb | 2.2.2-4.6.1 | SUSE-SU-2022:0361-1 |
| SUSE Enterprise Storage 7 | samba | 4.13.13+git.545.5897c2d94f3-3.12.1 | SUSE-SU-2022:0361-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-impacket | 0.13.1-1.2 | openSUSE-SU-2026:12011-1 |
| openSUSE Tumbleweed | samba | 4.15.2+git.193.a4d6307f1fd-1.1 | openSUSE-SU-2024:11631-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | samba +29 | 2:4.17.5-0.amzn2023.0.2 | ALAS2023-2023-032 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | samba | 4.18.3-1 | — |
| Azure Linux 2 (CBL-Mariner) | samba | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | libkadm5 +6 | 1.20.1-8.0.1.el9 | ELSA-2023-2570 |
| Oracle Linux 8 | bind-dyndb-ldap | 11.6-4.module+el8.9.0+90094+20819f5a | ELSA-2024-0143 |
| Oracle Linux 8 | custodia +1 | 0.6.0-3.module+el8.9.0+90094+20819f5a | ELSA-2024-0143 |
| Oracle Linux 8 | ipa-client +14 | 4.9.12-11.0.1.module+el8.9.0+90122+3305dc1d | ELSA-2024-0143 |
| Oracle Linux 8 | ipa-healthcheck +1 | 0.12-3.module+el8.9.0+90094+20819f5a | ELSA-2024-0143 |
| Oracle Linux 8 | opendnssec | 2.1.7-1.module+el8.9.0+90094+20819f5a | ELSA-2024-0143 |
| Oracle Linux 8 | python3-jwcrypto | 0.5.0-1.1.module+el8.9.0+90094+20819f5a | ELSA-2024-0143 |
| Oracle Linux 8 | python3-kdcproxy | 0.4-5.module+el8.9.0+90122+3305dc1d | ELSA-2024-0143 |
| Oracle Linux 8 | python3-pyusb | 1.0.0-9.1.module+el8.9.0+90094+20819f5a | ELSA-2024-0143 |
| Oracle Linux 8 | python3-qrcode +1 | 5.1-12.module+el8.9.0+90094+20819f5a | ELSA-2024-0143 |
| Oracle Linux 8 | python3-yubico | 1.3.2-9.1.module+el8.9.0+90094+20819f5a | ELSA-2024-0143 |
| Oracle Linux 8 | slapi-nis | 0.60.0-4.module+el8.9.0+90094+20819f5a | ELSA-2024-0143 |
| Oracle Linux 8 | softhsm +1 | 2.6.0-5.module+el8.9.0+90094+20819f5a | ELSA-2024-0143 |
Advisories 17
- ALSA-2023:2570 Moderate: krb5 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0143 Moderate: idm:DL1 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2022-0432 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2022-0302 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Oct 11, 2026
- openSUSE-SU-2026:12011-1 python313-impacket-0.13.1-1.2 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- RHSA-2024:0143 Red Hat Security Advisory: idm:DL1 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2024:0139 Red Hat Security Advisory: idm:DL1 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2024:0137 Red Hat Security Advisory: idm:DL1 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2023:2570 Red Hat Security Advisory: krb5 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- openSUSE-SU-2024:11631-1 ctdb-4.15.2+git.193.a4d6307f1fd-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0361-1 Security update for ldb, samba SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- RLSA-2024:0143 Moderate: idm:DL1 security update Rocky Linux Security Advisories · Oct 9, 2025
- ALAS2023-2023-032 Important: samba security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 15, 2024
- WID-SEC-2022-2280 Samba: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jan 15, 2024
- ELSA-2024-0143 Moderate: idm:DL1 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jan 12, 2024
- ELSA-2023-2570 Moderate: krb5 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 15, 2023