Medium, CVSS 6.9GoPublished
Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect
CVE-2026-50192 · GHSA-h5gx-45rj-2h5j
- Affected
- Go github.com/kerberos-io/agent/machinery < 0.0.0-20260528173546-51f1a52e170f
- Fixed in
- 0.0.0-20260528173546-51f1a52e170f· Vendor fix available
- Issue
- The Kerberos Hub upload path sends the agent's Hub credentials in the custom X-Kerberos-Hub-PrivateKey and X-Kerberos-Hub-PublicKey request headers to the operator-configured Hub URL (config.HubURI). The HTTP client used (&http.Client{} in UploadKerberosHub) is constructed without a CheckRedirect policy, so it follows HTTP redirects automatically. Go's net/http strips only sensitive headers (Authorization, Cookie, WWW-Authenticate) on a cross-host redirect; it does not strip custom headers such as X-Kerberos-Hub-PrivateKey. As a result, if the configured HubURI returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party (CWE-200 / CWE-522). Impact The Kerberos Hub private key (a long-lived secret authenticating the agent to Kerberos Hub) is leaked to an attacker-controlled host whenever the configured HubURI issues a cross-origin redirect. HubURI is operator configuration…
Recommended action: Upgrade to 0.0.0-20260528173546-51f1a52e170f (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.