CVE-2026-107884: Debian/krb5 vulnerability

Q: Which deployments are in scope for triage?

Prioritize Debian krb5 deployments that run kadmind and process password change protocol requests. The provided data does not identify affected package versions or configurations.

Q: What request path is relevant to exploitation?

The issue is associated with password change protocol requests handled by kadmind. The available information does not specify authentication requirements, network exposure requirements, or the resulting impact.

Published Nov 10, 2026

Updated

Check for the lockdownkeys attribute when processing password change protocol requests in kadmind

Affected Software

4 affected components

debian/krb5*

debian/krb5<=1.20.1-2+deb12u5, <=1.21.3-5+deb13u1, <=1.22.1-3

Event History

Nov 10, 2026

CVE Published

via OSV·08:47 AM

Data Sourced

via OSV·08:47 AM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are in scope for triage?

Prioritize Debian krb5 deployments that run kadmind and process password change protocol requests. The provided data does not identify affected package versions or configurations.

What request path is relevant to exploitation?