{"id":"CVE-2026-50192","sourceIdentifier":"security-advisories@github.com","published":"2026-08-20T22:17:20.390","lastModified":"2026-10-18T20:10:00.110","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` request headers to the operator-configured Hub URL (`config.HubURI`). The HTTP client used (`&http.Client{}` in `UploadKerberosHub`) is constructed without a `CheckRedirect` policy, so it follows HTTP redirects automatically. Go's `net/http` strips only sensitive headers (`Authorization`, `Cookie`, `WWW-Authenticate`) on a cross-host redirect; it does not strip custom headers such as `X-Kerberos-Hub-PrivateKey`. As a result, if the configured `HubURI` returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party. Version 3.6.26 fixes the issue by implementing the `CheckRedirect` strip plus a cross-host regression test is provided to the maintainer through the advisory's private temporary fork."},{"lang":"es","value":"Kerberos Agent es un agente de gestión de vídeo (vigilancia) de código abierto. Antes de la versión 3.6.26, la ruta de carga de Kerberos Hub envía las credenciales del Hub del agente en los encabezados de solicitud personalizados 'X-Kerberos-Hub-PrivateKey' y 'X-Kerberos-Hub-PublicKey' a la URL del Hub configurada por el operador ('config.HubURI'). El cliente HTTP utilizado ('&http.Client{}' en 'UploadKerberosHub') se construye sin una política de 'CheckRedirect', por lo que sigue las redirecciones HTTP automáticamente. El 'net/http' de Go elimina solo los encabezados sensibles ('Authorization', 'Cookie', 'WWW-Authenticate') en una redirección entre hosts; no elimina encabezados personalizados como 'X-Kerberos-Hub-PrivateKey'. Como resultado, si la 'HubURI' configurada devuelve una redirección 30x entre hosts, la clave privada del Hub se reenvía textualmente al destino de la redirección, divulgando la credencial a un tercero no deseado. La versión 3.6.26 soluciona el problema mediante la implementación de la eliminación de 'CheckRedirect', además de proporcionar una prueba de regresión entre hosts al mantenedor a través del fork temporal privado del aviso."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kerberos-io","product":"agent","versions":[{"version":"< 3.6.26","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-21T14:54:10.532284Z","id":"CVE-2026-50192","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://github.com/kerberos-io/agent/commit/51f1a52e170f21c1264c6de1dc781d5b5e2a5d09","source":"security-advisories@github.com"},{"url":"https://github.com/kerberos-io/agent/security/advisories/GHSA-h5gx-45rj-2h5j","source":"security-advisories@github.com"},{"url":"https://github.com/kerberos-io/agent/security/advisories/GHSA-h5gx-45rj-2h5j","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}