CVE-2026-107778
Last modified
CVE-2026-107778 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service..
Description
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| MIT | krb5 | <= 1.22.2 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-107778?
How severe is CVE-2026-107778?
How do I fix CVE-2026-107778?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-107736SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…6.8
- CVE-2026-107737SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…5.7
- CVE-2026-107738SumatraPDF is a multi-format reader for Windows. In 3.6.1 an…6.8
- CVE-2026-10774Zephyr's Bluetooth Mesh subnet key management leaks one PSA …6.5
- CVE-2026-10775A vulnerability was determined in sgl-project SGLang up to 0…5.3
- CVE-2026-10777A vulnerability was identified in ealpha072 Student-Manageme…7.3
- CVE-2026-107779Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e…9.8
- CVE-2026-107780Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e…9.8
- CVE-2026-107781Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e…7.4
- CVE-2026-107782System Informer before 4.0.26241.138 contains an incorrect a…7.8
- CVE-2026-10779The Classified Listing – Classified ads & Business Directory…4.3
- CVE-2026-107792Jivejdon from commit d58a36b0 through commit ee67a65e contai…4.3
Are you affected by CVE-2026-107778?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST