{"id":"CVE-2026-34397","aliases":["EUVD-2026-17983","GHSA-v7xx-7mqc-g835","SUSE-SU-2026:1361-1","SUSE-SU-2026:21437-1","openSUSE-SU-2026:10483-1","openSUSE-SU-2026:20658-1"],"status":"published","title":"himmelblau: NSS fake-primary group lookup reintroduces name collision risk","description":"Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., \"sudo\", \"wheel\", \"docker\", \"adm\") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00164,"percentile":0.05627,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2026-04-01T17:25:06Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"himmelblau","fixed_in":["2.3.9+git0.a9fd29b-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9+git0.a9fd29b-150700.3.15.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9+git0.a9fd29b-1.1"}]}]}],"products":[{"vendor":"himmelblau-idm","product":"himmelblau"}],"references":[{"url":"https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-v7xx-7mqc-g835","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Vendor Advisory","advisory"]},{"url":"https://github.com/himmelblau-idm/himmelblau/releases/tag/2.3.9","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/himmelblau-idm/himmelblau/releases/tag/3.1.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34397.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34397","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261361-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233949","tags":["report"]},{"url":"https://bugzilla.suse.com/1245437","tags":["report"]},{"url":"https://bugzilla.suse.com/1247735","tags":["report"]},{"url":"https://bugzilla.suse.com/1249013","tags":["report"]},{"url":"https://bugzilla.suse.com/1257904","tags":["report"]},{"url":"https://bugzilla.suse.com/1258236","tags":["report"]},{"url":"https://bugzilla.suse.com/1259548","tags":["report"]},{"url":"https://bugzilla.suse.com/1261324","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34397","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621437-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261613","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34397","title":"himmelblau: NSS fake-primary group lookup reintroduces name collision risk","description":"Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., \"sudo\", \"wheel\", \"docker\", \"adm\") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.","status":"published","published":"2026-04-01T17:25:06.034Z","modified":"2026-04-04T03:05:13.451Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-17983","description":"Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., \"sudo\", \"wheel\", \"docker\", \"adm\") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.","status":"published","published":"2026-04-01T17:25:06Z","modified":"2026-04-04T03:05:13Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:16.550278Z"}],"nvd":[{"id":"CVE-2026-34397","description":"Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., \"sudo\", \"wheel\", \"docker\", \"adm\") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.","status":"published","published":"2026-04-01T18:16:30.33Z","modified":"2026-06-17T10:39:00.71Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:12:12.73929Z"}],"osv":[{"id":"CVE-2026-34397","title":"himmelblau: NSS fake-primary group lookup reintroduces name collision risk","description":"Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., \"sudo\", \"wheel\", \"docker\", \"adm\") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.","status":"published","published":"2026-04-01T17:25:06.034Z","modified":"2026-10-28T02:30:24.025398368Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"openSUSE-SU-2026:10483-1","title":"himmelblau-2.3.9+git0.a9fd29b-1.1 on GA media","description":"These are all security issues fixed in the himmelblau-2.3.9+git0.a9fd29b-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-03T00:00:00Z","modified":"2026-04-04T07:30:06.670719Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20658-1","title":"Security update for himmelblau","description":"This update for himmelblau fixes the following issues:\n\nUpdate to version 2.3.9+git0.a9fd29b.\n\nSecurity issues fixed:\n\n- CVE-2026-34397: Fixed naming collision that can lead to local privilege escalation (bsc#1261324).\n\nOther updates and bugfixes:\n\n- update aws-lc-sys to 0.39.0 for security fixes\n- update rustls-webpki to 0.103.10 for CRL revocation fix\n- Version 2.3.9:\n  * packaging: fix if/else block for debian's postrm\n  * Update apparmor.unix-chkpwd.local (Issue #1252)\n  * When Hello user encounters SSPR demand, be permissive\n  * add tests for sudo_groups functionality\n  * Fix config tests to ignore local host config\n  * Do not clear $NOTIFY_SOCKET when calling sd_ready\n  * Fix token cache 24h purge\n  * broker: use SSO server nonce for PRT only when provided\n  * Fix pam_himmelblau blocking local user password changes (#1199)\n  * Remove unused File import\n  * Use is_ascii_alphanumeric() for account_id validation\n  * Fix path traversal in LoadProfilePhoto AccountsService writes\n  * Drop initialization tracing span\n  * himmelblau-hsm-pin-init: drop RemainAfterExit=yes\n  * Add fallback behavior when consent is required\n  * qr-greeter: enable extension without socket noise\n  * debian: make install/remove noninteractive; reduce QR postinst noise; soften missing hello prt\n  * Never respond with BadRequest without error detail\n  * deps(rust): bump the all-cargo-updates group across 1 directory with 7 updates\n","status":"published","published":"2026-04-30T17:08:24Z","modified":"2026-05-05T18:23:53.091474Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1361-1","title":"Security update for himmelblau","description":"This update for himmelblau fixes the following issues:\n\nUpdate to version 2.3.9+git0.a9fd29b; (jsc#PED-14511):\n\n- CVE-2026-34397: Fix LPE due to name collision during NSS fake-primary group lookup (bsc#1261324).\n- CVE-2026-31979: Fix race condition when accessiung /tmp/krb5cc_uid (bsc#1259548).\n- CVE-2026-25727: deps(rust): Bump the `all-cargo-updates` group with 8 updates (bsc#1257904).\n- CVE-2025-58160: deps(rust): Bump `tracing-subscriber` in the cargo group (bsc#1249013).\n- CVE-2025-54882: Fix Kerberos credential cache permissions (bsc#1247735).\n- CVE-2025-53013: Fix permitted authentication with invalid Hello PIN (bsc#1245437).\n- CVE-2024-11738: Fix `rustls` network-reachable panic in `Acceptor::accept` (bsc#1233949).\n\nOther bug fixes:\n\n- Fix SELinux module packaging to use standard policy macros (bsc#1258236).\n","status":"published","published":"2026-04-15T14:14:00Z","modified":"2026-04-16T08:30:39.316405Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:21437-1","title":"Security update for himmelblau","description":"This update for himmelblau fixes the following issues:\n\nUpdate to version 2.3.9+git0.a9fd29b.\n\nSecurity issues fixed:\n\n- CVE-2026-34397: Fixed naming collision that can lead to local privilege escalation (bsc#1261324).\n\nOther updates and bugfixes:\n\n- update aws-lc-sys to 0.39.0 for security fixes\n- update rustls-webpki to 0.103.10 for CRL revocation fix\n- Version 2.3.9:\n  * packaging: fix if/else block for debian's postrm\n  * Update apparmor.unix-chkpwd.local (Issue #1252)\n  * When Hello user encounters SSPR demand, be permissive\n  * add tests for sudo_groups functionality\n  * Fix config tests to ignore local host config\n  * Do not clear $NOTIFY_SOCKET when calling sd_ready\n  * Fix token cache 24h purge\n  * broker: use SSO server nonce for PRT only when provided\n  * Fix pam_himmelblau blocking local user password changes (#1199)\n  * Remove unused File import\n  * Use is_ascii_alphanumeric() for account_id validation\n  * Fix path traversal in LoadProfilePhoto AccountsService writes\n  * Drop initialization tracing span\n  * himmelblau-hsm-pin-init: drop RemainAfterExit=yes\n  * Add fallback behavior when consent is required\n  * qr-greeter: enable extension without socket noise\n  * debian: make install/remove noninteractive; reduce QR postinst noise; soften missing hello prt\n  * Never respond with BadRequest without error detail\n  * deps(rust): bump the all-cargo-updates group across 1 directory with 7 updates\n","status":"published","published":"2026-04-30T17:06:48Z","modified":"2026-05-05T18:23:52.549454Z","updated_at":"2026-11-02T15:54:02.312556Z"}]}}