{"id":"CVE-2026-50192","title":"Kerberos Agent is an open source video (surveillance) management agent","summary":"Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` requ…","severity":"medium","cwe":["CWE-200","CWE-522"],"vendor":"kerberos-io","product":"github.com/kerberos-io/agent/machinery","affected":["github.com/kerberos-io/agent/machinery < 0.0.0-20260528173546-51f1a52e170f"],"patched":["github.com/kerberos-io/agent/machinery 0.0.0-20260528173546-51f1a52e170f"],"published":"2026-08-20","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50192","references":[{"url":"https://github.com/kerberos-io/agent/commit/51f1a52e170f21c1264c6de1dc781d5b5e2a5d09","label":"security-advisories@github.com"},{"url":"https://github.com/kerberos-io/agent/security/advisories/GHSA-h5gx-45rj-2h5j","label":"security-advisories@github.com"},{"url":"https://github.com/kerberos-io/agent/security/advisories/GHSA-h5gx-45rj-2h5j","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-h5gx-45rj-2h5j"}],"tags":["nvd","ghsa","go"],"epss":0.00315,"epssPercentile":0.24521,"ecosystem":"go","ingestedAt":"2026-07-02T17:40:39.293Z","slug":"CVE-2026-50192","body":"## Overview\n\nKerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` request headers to the operator-configured Hub URL (`config.HubURI`). The HTTP client used (`&http.Client{}` in `UploadKerberosHub`) is constructed without a `CheckRedirect` policy, so it follows HTTP redirects automatically. Go's `net/http` strips only sensitive headers (`Authorization`, `Cookie`, `WWW-Authenticate`) on a cross-host redirect; it does not strip custom headers such as `X-Kerberos-Hub-PrivateKey`. As a result, if the configured `HubURI` returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party. Version 3.6.26 fixes the issue by implementing the `CheckRedirect` strip plus a cross-host regression test is provided to the maintainer through the advisory's private temporary fork.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-50192)\n\nAffected packages:\n\n- `github.com/kerberos-io/agent/machinery < 0.0.0-20260528173546-51f1a52e170f`\n\nPatched in:\n\n- `github.com/kerberos-io/agent/machinery 0.0.0-20260528173546-51f1a52e170f`\n\nSource: https://github.com/advisories/GHSA-h5gx-45rj-2h5j","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}