krb5 -- MIT krb5 Security Advisory 2026-001

The MIT KRB5 Project reports:

An authenticated attacker can bypass authentication indicator enforcement by requesting a service ticket with fake CAMMAC authorization data. Updating to the 1.22.3 release on the KDC is sufficient to prevent this attack.

An authenticated attacker can bypass an application server's PAC authorization data checks by requesting a service ticket with a fake PAC. Updating to the 1.22.3 release on either the KDC or the affected application server will prevent this attack.

An authenticated attacker with administrative privileges can bypass the lockdown_keys attribute by using the password change protocol instead of the kadmin protocol to modify a principal's keys.

The KDC, kadmind, and GSS-API application servers are all vulnerable to denial of service attacks by unauthenticated attackers.

[source]