The himmelblaud-tasks daemon, which runs as root, creates Kerberos cache files in /tmp/krb5cc_\<uid> without protection against symlink attacks. The removal of PrivateTmp exposes this directory to the host, allowing a local user to create a symlink to an arbitrary file, change its ownership or overwrite it during cache creation. This flaw enables an attacker with local access to gain root privileges on the host. The weakness corresponds to CWE‑59: Improper Restriction of Operations within the Bounds of a Resource.

himmelblau-idm provides the himmelblau product. Versions prior to 3.1.0 and 2.3.8 of the himmelblaud‑tasks component are vulnerable. Users on these releases should upgrade.

The vulnerability carries a CVSS score of 8.8 indicating high severity. The EPSS score is below 1 percent, indicating low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. The attack vector is local with the attacker needing only user-level access to create a symbolic link in /tmp. Once the symlink is in place, the daemon will perform a chown or overwrite on the target during cache generation, which grants system-wide privileges.