CVE-2026-50192

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50192
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50192.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50192
Aliases
Downstream
Related
Published
2026-08-20T21:37:20Z
Modified
2026-08-23T03:42:58Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Kerberos Hub private key (X-Kerberos-Hub-PrivateKey) leaked to cross-host redirect target due to redirect-following HTTP client without CheckRedirect
Details

Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom X-Kerberos-Hub-PrivateKey and X-Kerberos-Hub-PublicKey request headers to the operator-configured Hub URL (config.HubURI). The HTTP client used (&http.Client{} in UploadKerberosHub) is constructed without a CheckRedirect policy, so it follows HTTP redirects automatically. Go's net/http strips only sensitive headers (Authorization, Cookie, WWW-Authenticate) on a cross-host redirect; it does not strip custom headers such as X-Kerberos-Hub-PrivateKey. As a result, if the configured HubURI returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party. Version 3.6.26 fixes the issue by implementing the CheckRedirect strip plus a cross-host regression test is provided to the maintainer through the advisory's private temporary fork.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-522"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50192.json"
}
References

Affected packages

Git / github.com/kerberos-io/agent

Affected ranges

Type
GIT
Repo
https://github.com/kerberos-io/agent
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
51f1a52e170f21c1264c6de1dc781d5b5e2a5d09
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.6.26"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
026bf93
02f3e6a
0680636
14d38ec
15d9bcd
192f78a
1a6dc27
21d81b9
229c246
24c729e
25537b5
2681bd2
2860775
2fad541
2feda33
31a0b9e
3341e99
3cb3809
4352d99
43d12ee
442ba97
4a4aabd
4aa8ce7
4c41301
4cc8135
530e4c6
60e8edc
65d3d64
6672535
6f8745d
6fcd6e5
71cd315
751aa17
7671b1c
7e6b698
83ba7ba
84e532b
87f681c
898a118
913bd1b
926f9ea
9339ae3
93f40a8
99cc7d4
9aff467
9cf9bab
9d70778
a098052
a0f99a5
a2b4ee1
aac2150
af95c0f
afefd32
b058c1e
b172284
b4a8028
b64f103
b67a72b
bbbed49
be02774
c278a66
c59d511
ca24133
ca36761
ced6e67
d4e1008
d6ba875
d7f7de9
d9694ac
deb0308
e9ea34c
eb5ab48
ec42b9e
ed397b6
f739d52
f935360
fa91e84
3.*
3.2.0
3.2.1
3.2.2
3.2.3
v0.*
v0.0.1-alpha
v1.*
v1.0.0-beta
v3.*
v3.2.10
v3.2.4
v3.2.5
v3.2.6
v3.2.7
v3.2.8
v3.2.9
v3.3.0
v3.3.1
v3.3.10
v3.3.11
v3.3.12
v3.3.13
v3.3.14
v3.3.15
v3.3.16
v3.3.17
v3.3.18
v3.3.19
v3.3.19-onvif-v0.0.14
v3.3.2
v3.3.20
v3.3.21
v3.3.3
v3.3.4
v3.3.5
v3.3.7
v3.3.8
v3.3.9
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.5.4
v3.5.5
v3.5.6
v3.6.0
v3.6.1
v3.6.10
v3.6.11
v3.6.12
v3.6.13
v3.6.14
v3.6.15
v3.6.16
v3.6.17
v3.6.18
v3.6.19
v3.6.2
v3.6.20
v3.6.21
v3.6.22
v3.6.23
v3.6.24
v3.6.25
v3.6.3
v3.6.4
v3.6.5
v3.6.6
v3.6.7
v3.6.8
v3.6.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50192.json"