CVE Alert: CVE-2026-112320 – Red Hat

The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.

**Risk verdict:** This is a high operational risk for reachable administration services; no KEV, SSVC, PoC or EPSS data was provided, so active exploitation and urgency cannot be confirmed.

**Why this matters:** A remote attacker could exhaust service memory and interrupt Kerberos administration, delaying account, policy or key changes. The direct impact is availability rather than credential theft; disruption could nevertheless hamper response to a separate identity incident.

**Most likely attack path:** The service is reachable over a network and the attack requires neither prior privileges nor user interaction, making exposed instances comparatively easy to target. Repeated connection and authentication-flavour changes may exhaust memory; the stated scope is unchanged, so direct compromise or lateral movement is not indicated.

**Who is most exposed:** Organisations running the administration daemon on hosts reachable from broad internal networks or the internet are most exposed, particularly where it is not restricted to dedicated administrative networks.

Alert on unusual connection rates to the administration service, especially from untrusted or unexpected sources.

Monitor daemon memory growth alongside connection and authentication-context churn.

Correlate service restarts, failed administration requests and authentication-service availability alerts.

Review firewall and network-flow logs for repeated short-lived sessions.

Mitigation and prioritisation:

Apply the vendor’s security update promptly, after confirming package applicability.

Until patched, restrict network access to trusted administrative hosts; disable the daemon where operationally feasible.

Test changes against administration workflows and maintain a recovery route before disabling the service.

Check for service instability or resource exhaustion since exposure began; supplied data does not establish exploitation.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.