CVE-2025-54882 Himmelblau's Kerberos credential cache collection is world readable
Himmelblau stores Kerberos credential caches with world-readable permissions, allowing local attackers to read sensitive cloud TGTs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54882?
CVE-2025-54882 is a high-severity vulnerability in himmelblau-idm himmelblau, published on 7 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.
Weakness: CWE-522
Which versions are affected by CVE-2025-54882?
It affects 1 product.
Linux distribution packages (1)
himmelblau openSUSE:Tumbleweed | All versions | 1.2.0+git.0.6befefc-1.1 |
Products include Himmelblau-Idm Himmelblau.
How do I fix CVE-2025-54882?
Upgrade to a fixed version.
Is CVE-2025-54882 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54882 exists.
Other vulnerabilities in himmelblau-idm himmelblau
- CVE-2026-31957 Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments
- CVE-2026-31979 himmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccache
- CVE-2026-34397 himmelblau: NSS fake-primary group lookup reintroduces name collision risk
Sources
Also known as GHSA-phfx-rjfw-wj83, openSUSE-SU-2025:15425-1.