{"items":[{"id":"NVI-00017653","kind":"vulnerability","title":"Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-h5gx-45rj-2h5j","CVE-2026-50192"],"plain_summary":"GitHub lists this reviewed advisory for github.com/kerberos-io/agent/machinery. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3b4a0f366e1b04e3124c832c323877f2"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3b4a0f366e1b04e3124c832c323877f2","url":"https://github.com/advisories/GHSA-h5gx-45rj-2h5j","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-h5gx-45rj-2h5j","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T03:47:42.887Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3b4a0f366e1b04e3124c832c323877f2"],"technology":"github.com/kerberos-io/agent/machinery","known_exclusions":[],"conditions_summary":"### Summary\n\nThe Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` request headers to the operator-configured Hub URL (`config.HubURI`). The HTTP client used (`&http.Client{}` in `UploadKerberosHub`) is constructed without a `CheckRedirect` policy, so it follows HTTP redirects automatically. Go's `net/http` strips only sensitive headers (`Authorization`, `Cookie`, `WWW-Authenticate`) on a cross-host redirect; it does **not** strip custom headers such as `X-Kerberos-Hub-PrivateKey`. As a result, if the configured `HubURI` returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party (CWE-200 / CWE-522).\n\n### Impact\n\nThe Kerberos Hub private key (a long-lived secret authenticating the agent to Kerberos Hub) is leaked to an attacker-controlled host whenever the configured `HubURI` issues a cross-origin redirect. `HubURI` is operator configuration (`models.Config.HubURI`, JSON `hub_uri`); an open redirect on that host, a compromised/hijacked Hub deployment, a DNS/BGP hijack, or a malicious URL supplied in the age","public_affected_ranges":["< 0.0.0-20260528173546-51f1a52e170f"]}],"null_published_at":"2026-11-05T19:10:21.447Z","source_updated_at":"2026-07-02T17:33:37.000Z","source_disclosed_at":"2026-07-02T17:33:36.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T03:47:42.887Z"}],"next_cursor":null,"snapshot_revision":"42594"}