CVE-2026-31979: The Symlink Trap — Root Privilege Escalation in Himmelblau

Key Takeaways

• CVE-2026-31979 is a high-severity (CVSS 8.8) local privilege escalation vulnerability in the Himmelblau interoperability suite.
• The flaw is a TOCTOU symlink race condition in the himmelblaud-tasks daemon's handling of Kerberos credential cache files in the shared /tmp directory.
• Successful exploitation grants an unprivileged local user full root access by tricking the daemon into changing ownership of critical system directories like /etc.
• The vulnerability affects versions prior to 3.1.0 and 2.3.8 due to missing O_NOFOLLOW flags and the removal of systemd PrivateTmp isolation.
• A temporary workaround is available by manually re-enabling PrivateTmp=true in the himmelblaud-tasks systemd service override.

Affected Systems

• Linux systems running Himmelblau versions prior to 3.1.0 and 2.3.8
• himmelblaud-tasks daemon

Vulnerabilities (CVEs)

• CVE-2026-31979

Attack Chain

An attacker with unprivileged local access creates a symbolic link in the shared /tmp directory (e.g., /tmp/krb5cc_<uid>) pointing to a critical system directory like /etc. The attacker then triggers a Kerberos authentication flow using tools like aad-tool or a PAM login. The himmelblaud-tasks daemon, running as root and lacking namespace isolation, follows the symlink and executes a chown operation on the target. This grants the unprivileged attacker ownership of the critical directory, allowing them to modify sensitive files and achieve full root privilege escalation.

Detection Availability

• YARA Rules: No
• Sigma Rules: Yes
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: Yes
• EQL Queries: No
• Other Detection Logic: Yes
• Platforms: Sigma, Splunk, Akamai Guardicore

The article provides a Sigma rule and a Splunk search query leveraging Linux auditd logs to detect the himmelblaud-tasks daemon executing chown syscalls on /tmp/krb5cc_* paths. Akamai Guardicore queries are also mentioned.

Detection Engineering Assessment

EDR Visibility: High — EDR and auditd solutions have strong visibility into syscalls (chown, fchown) and file modifications, especially when a specific process (/usr/sbin/himmelblaud-tasks) is involved. Network Visibility: None — This is a purely local privilege escalation vulnerability exploiting local file system race conditions; no network traffic is generated during the exploit. Detection Difficulty: Moderate — While the specific syscalls and paths are known, detecting TOCTOU race conditions reliably without generating false positives from legitimate Kerberos cache creations requires precise correlation of symlink creation and subsequent chown operations.

Required Log Sources

• Linux auditd
• EDR File Modification Logs
• EDR Process Execution Logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Look for the himmelblaud-tasks process executing chown or fchown system calls on files within the /tmp directory, particularly those matching the krb5cc_* pattern.	Linux auditd (SYSCALL events) or EDR file modification logs	Privilege Escalation	Low
Identify unprivileged users creating symbolic links in /tmp that point to critical system directories like /etc or /root.	EDR file creation logs or auditd	Preparation	Low

Control Gaps

• Lack of systemd namespace isolation (PrivateTmp=false)
• Insecure file operations (path-based instead of file-descriptor-based)

Key Behavioral Indicators

• chown/fchown syscalls executed by himmelblaud-tasks
• Symlink creation in /tmp targeting privileged directories

False Positive Assessment

• Low. The specific combination of himmelblaud-tasks executing chown on a symlink pointing to a sensitive directory like /etc is highly indicative of exploitation and unlikely to occur during normal operations.

Recommendations

Immediate Mitigation

• Patch Himmelblau to version 3.1.0 or 2.3.8 immediately.
• If patching is not possible, manually re-enable systemd sandboxing by creating an override for the himmelblaud-tasks service and adding 'PrivateTmp=true'.

Infrastructure Hardening

• Ensure systemd services running as root utilize PrivateTmp and other namespace isolation features to prevent shared /tmp directory attacks.
• Audit custom and third-party daemons for secure file handling practices, specifically the use of O_NOFOLLOW and lchown.

User Protection

• Restrict local access to critical identity bridge servers to authorized administrators only.

Security Awareness

• Educate developers and system administrators on the risks of TOCTOU vulnerabilities and secure file operations in shared directories.

MITRE ATT&CK Mapping

• T1068 - Exploitation for Privilege Escalation
• T1548 - Abuse Elevation Control Mechanism

Additional IOCs

• File Paths:
  • /etc - Example of a privileged target directory an attacker might attempt to take ownership of.
• Command Lines:
  • Purpose: Create malicious symlink pointing to a privileged directory | Tools: ln | Stage: Exploitation | ln -s /etc /tmp/krb5cc_
  • Purpose: Trigger Kerberos authentication flow to execute the vulnerable daemon logic | Tools: aad-tool | Stage: Exploitation | aad-tool auth login