{"id":"CVE-2026-50192","revision":"f928ea6a094c434683df75c454b01442","records":[{"revision":"f928ea6a094c434683df75c454b01442","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-50192","aliases":[],"title":"Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect","description":"Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` request headers to the operator-configured Hub URL (`config.HubURI`). The HTTP client used (`&http.Client{}` in `UploadKerberosHub`) is constructed without a `CheckRedirect` policy, so it follows HTTP redirects automatically. Go's `net/http` strips only sensitive headers (`Authorization`, `Cookie`, `WWW-Authenticate`) on a cross-host redirect; it does not strip custom headers such as `X-Kerberos-Hub-PrivateKey`. As a result, if the configured `HubURI` returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party. Version 3.6.26 fixes the issue by implementing the `CheckRedirect` strip plus a cross-host regression test is provided to the maintainer through the advisory's private temporary fork.","state":0,"publishedAt":"2026-08-20T21:37:20.598+00:00","modifiedAt":"2026-08-21T14:54:20.323+00:00","affected":[{"ecosystem":"Vendor product","name":"agent","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"kerberos-io\",\n                    \"product\": \"agent\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.6.26\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/kerberos-io/agent/security/advisories/GHSA-h5gx-45rj-2h5j","https://github.com/kerberos-io/agent/commit/51f1a52e170f21c1264c6de1dc781d5b5e2a5d09"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-50192","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-50192","identifiers":["CVE-2026-50192"]},"retained":false,"historicalAffected":[]}],"coverage":[]}