Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-50192— Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect

Quick assessment

Affected
kerberos-io agent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kerberos Agent 是一款开源的视频（监控）管理代理程序。在 3.6.26 版本之前，Kerberos Hub 的上传路径会将代理的 Hub 凭据以自定义请求头 和 的形式，发送至由运营人员配置的 Hub URL（ ）。在 函数中使用的 HTTP 客户端（ ）在构造时未设置 策略，因此会自动跟随 HTTP 重定向。Go 语言的 包仅在跨主机重定向时移除敏感头（如 、 、 ），而不会移除 这类自定义头。因此，如果配置的 返回一个跨主机的 3xx 重定向响应，Hub 私有密钥将未经任何处理地被原样转发至重定向

CVSS 6.9 · Medium EPSS 0.25% · P16

Affected Version Matrix 1

VendorProduct Version RangeStatus
kerberos-io agent < 3.6.26 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-50192

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect
Source: CVE Program / CVE List V5
Vulnerability Description
Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` request headers to the operator-configured Hub URL (`config.HubURI`). The HTTP client used (`&http.Client{}` in `UploadKerberosHub`) is constructed without a `CheckRedirect` policy, so it follows HTTP redirects automatically. Go's `net/http` strips only sensitive headers (`Authorization`, `Cookie`, `WWW-Authenticate`) on a cross-host redirect; it does not strip custom headers such as `X-Kerberos-Hub-PrivateKey`. As a result, if the configured `HubURI` returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party. Version 3.6.26 fixes the issue by implementing the `CheckRedirect` strip plus a cross-host regression test is provided to the maintainer through the advisory's private temporary fork.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
kerberos-io agent < 3.6.26 -

II. Public POCs for CVE-2026-50192

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-50192

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-50192 (1)

Vendor Advisories for CVE-2026-50192 (1)

IV. Related Vulnerabilities

Same product: agent
Same weakness: CWE-200

V. Comments for CVE-2026-50192

No comments yet

Leave a comment