Live › vulnerability › CVE-2026-57915
Apache Kerby, a Java Kerberos library, can be made to skip its Kerberos pre-authentication check by sending a PA-DATA element with an unrecognized or unsupported type. An attacker who can reach the Kerberos server built on kerb-server can get past pre-authentication without valid credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 22:02 UTC, 0h before NVD. All times on this page are UTC.
Teams whose Java applications or services use the Apache Kerby kerb-server artifact below 2.1.2 to act as a Kerberos server or KDC. Applications that only use Kerberos clients or a different Kerberos implementation are not in the stated range. The sources do not say which default configurations are exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.kerby:kerb-server | maven | < 2.1.2 | 2.1.2 |
mvn dependency:tree and look for org.apache.kerby:kerb-server; a version below 2.1.2 is affected.kerb-server pinned to an older version.2.1.2.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-57915")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.