BSD Portskrb5 -- MIT krb5 Security Advisory 2026-001
· CVE-2026-71199, CVE-2026-107884, CVE-2026-111423, CVE-2026-40355, CVE-2026-40356, CVE-2026-71200, CVE-2026-107364, CVE-2026-107708, CVE-2026-107778, CVE-2026-112314, CVE-2026-112315, CVE-2026-112316, CVE-2026-112317, CVE-2026-112318, CVE-2026-112319, CVE-2026-112320, CVE-2026-112321, CVE-2026-112322, CVE-2026-112323, CVE-2026-119079 · VuXML entry
The MIT KRB5 Project reports: An authenticated attacker can bypass authentication indicator enforcement by requesting a service ticket with fake CAMMAC authorization data. Updating to the 1.22.3 release on the KDC is sufficient to prevent this attack. An authenticated attacker can bypass an application server's PAC authorization data checks by requesting a service ticket with a fake PAC. Updating to the 1.22.3 …
Affected versions
- krb5 < 1.22.3
- krb5-122 < 1.22.3
- krb5-devel < 2026-11-05
By system
3 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/krb5 | 1.22.2_3 | vulnerable since 2026-11-10 | |
| MidnightBSD | security/krb5 | in range, by version | ||
| FreeBSD | security/krb5 | 1.22.3 | fixed | |
| DragonFly | security/krb5-122 | 1.22.2_3 | vulnerable since 2026-11-10 | |
| FreeBSD | security/krb5-122 | 1.22.3 | fixed | |
| FreeBSD | security/krb5-devel | 1.23.2026.11.05 | vulnerable since 2026-11-10 |