The Kerberos Agent uses a custom HTTP client that automatically follows redirects. When the Hub upload path is configured to point at a URL that responds with a cross‑host 30x redirect, the client forwards request headers to the new location. Go’s standard library removes only standard authentication headers during such a redirect, leaving custom headers untouched. Consequently, the private and public key headers sent to the original Hub are leaked to the unintended third‑party server. This exposure allows an attacker who can force the redirect to observe the private key, potentially granting them unauthorized access to the Kerberos Hub and any connected surveillance resources.

The issue affects the Kerberos‑IO Agent versions earlier than 3.6.26. The product is released under the vendor kerberos‑io:agent. Only deployments that use a Hub URI configured to a host that can issue cross‑host redirects are vulnerable. No specific patch versions are listed beyond 3.6.26, which supposedly resolves the problem.

The CVSS base score of 6.9 indicates a moderate risk. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need to influence the HubURI to point to a malicious or compromised host capable of providing a redirect, or otherwise intercept the request chain. Once the redirect occurs, the victim’s private key is transmitted verbatim, satisfying CWE‑200 (Information Exposure) and CWE‑522 (Insufficient Credential Storage). There are no known active exploits reported at this time, but the lack of header stripping is a predictable weakness that could be leveraged by an adversary who can control the redirect target or manipulate the network traffic.