Executive brief
Kerberos Agent is a video surveillance software component that uploads data to a central Hub. A security flaw allows sensitive authentication keys to be leaked to unauthorized third parties if the Hub server issues a redirect to a different web address. An attacker who obtains these keys could impersonate the surveillance device and gain unauthorized access to the Kerberos Hub account.
Technical details
The vulnerability exists in the `UploadKerberosHub` function within `machinery/src/cloud/kerberos_hub.go`. The Go HTTP client is initialized without a `CheckRedirect` policy, causing it to automatically follow redirects. While Go's standard library strips standard sensitive headers like `Authorization` during cross-host redirects, it does not strip custom headers. Consequently, the `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` headers are forwarded to any external host specified in a 30x redirect response. An attacker can exploit this via an open redirect on the configured Hub, DNS hijacking, or by providing a malicious Hub URL in the agent configuration to exfiltrate long-lived credentials. A fix is available in version 0.0.0-20260528173546-51f1a52e170f.
Affected products
- kerberos-io agent/machinery < 0.0.0-20260528173546-51f1a52e170f
Timeline
- 2026-05-28: patched: Initial patch version released
- 2026-07-02: advisory: Advisory published