CVE-2026-50192Medium▾ SunlitKerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` requ…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.3%
Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom X-Kerberos-Hub-PrivateKey and X-Kerberos-Hub-PublicKey request headers to the operator-configured Hub URL (config.HubURI). The HTTP client used (&http.Client{} in UploadKerberosHub) is constructed without a CheckRedirect policy, so it follows HTTP redirects automatically. Go's net/http strips only sensitive headers (Authorization, Cookie, WWW-Authenticate) on a cross-host redirect; it does not strip custom headers such as X-Kerberos-Hub-PrivateKey. As a result, if the configured HubURI returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party. Version 3.6.26 fixes the issue by implementing the CheckRedirect strip plus a cross-host regression test is provided to the maintainer through the advisory's private temporary fork.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/kerberos-io/agent/machinery < 0.0.0-20260528173546-51f1a52e170fPatched in:
github.com/kerberos-io/agent/machinery 0.0.0-20260528173546-51f1a52e170fConnected by shared product, vendor, weakness, or advisory.
CVE-2026-49449Low· 2.5Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks
CVE-2026-45726High· 7.6Omni manages Kubernetes on bare metal, virtual machines, or in a cloud
CVE-2021-25122High· 7.5When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning u…
CVE-2022-31746Medium· 6.5Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header
CVE-2026-44979None@hapi/wreck is an HTTP client utility
CVE-2026-47282Medium· 6.5Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.