Description
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| himmelblau-idm | himmelblau | >= 0.8.0, < 0.9.22, >= 1.0.0-beta, < 1.2.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | himmelblau | 2.3.9+git0.a9fd29b-150700.3.15.1 | SUSE-SU-2026:1361-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | himmelblau | 2.3.8+git0.dec3693-160000.1.1 | SUSE-FU-2026:20990-1 |
| SLES 16.0 | himmelblau | 2.3.8+git0.dec3693-160000.1.1 | SUSE-FU-2026:20990-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | himmelblau | 1.2.0+git.0.6befefc-1.1 | openSUSE-SU-2025:15425-1 |
| openSUSE Leap 16.0 | himmelblau | 2.3.8+git0.dec3693-160000.1.1 | openSUSE-FU-2026:20453-1 |
Advisories 4
- SUSE-SU-2026:1361-1 Security update for himmelblau SUSE / openSUSE Security Updates · Apr 16, 2026
- SUSE-FU-2026:20990-1 Feature update for himmelblau SUSE / openSUSE Security Updates · Apr 10, 2026
- openSUSE-FU-2026:20453-1 Feature update for himmelblau SUSE / openSUSE Security Updates · Apr 3, 2026
- openSUSE-SU-2025:15425-1 himmelblau-1.2.0+git.0.6befefc-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
References
- https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83
- https://github.com/himmelblau-idm/himmelblau/commit/b562053df3dffb1dd9ab3d09af986886773be2ad
- https://github.com/himmelblau-idm/himmelblau/commit/faae58b0384aca8b21b4be5f1c507412eec3778a
- https://github.com/himmelblau-idm/himmelblau/releases/tag/0.9.22
- https://github.com/himmelblau-idm/himmelblau/releases/tag/1.2.0