CVE-2025-59088: Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv
An unauthenticated client can control which host:port the proxy connects to by choosing a realm whose DNS publishes SRV records, leading to unbounded SRV auto discovery being used to make server-side connections across a trust boundary (including localhost/RFC1918) with no port/address policy and no validation of upstream responses, resulting in SSRF (CWE-918), data exfiltration, and origin-cloaked egress.
Other sources
If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the "usedns" setting is explicitly set to false are not affected.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the kdcproxy configuration has "use_dns" set to false to prevent default SRV record DNS auto-discovery for attacker-supplied realms.
kdcproxy (Python-kdcproxy) use_dns = false - Compensating control
If SRV-based discovery is required, restrict DNS SRV records and the set of realms that kdcproxy is allowed to query so attackers cannot create/choose realms with SRV records that resolve to localhost (127.0.0.1) or RFC1918/internal addresses/ports.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59088?
CVE-2025-59088 is classified as a high-severity vulnerability due to its potential for server-side request forgery.
How do I fix CVE-2025-59088?
To mitigate CVE-2025-59088, configure valid server addresses for all realms in the kdcproxy configuration.
What software is affected by CVE-2025-59088?
CVE-2025-59088 affects the Python kdcproxy software.
Can CVE-2025-59088 lead to unauthorized access?
Yes, CVE-2025-59088 can potentially lead to unauthorized access via server-side request forgery.
Is there a workaround for CVE-2025-59088?
A temporary workaround for CVE-2025-59088 is to disable the DNS query feature for realms without defined server addresses.