CVE-2026-25506
📋 TL;DR
A buffer overflow vulnerability in MUNGE authentication daemon (munged) versions 0.5 to 0.5.17 allows local attackers to leak cryptographic key material from process memory. With the leaked key material, attackers can forge arbitrary MUNGE credentials to impersonate any user, including root, to services relying on MUNGE for authentication. This affects systems running vulnerable versions of MUNGE authentication service.
💻 Affected Systems
- MUNGE authentication service
📦 What is this software?
Munge by Opensuse
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains ability to forge MUNGE credentials for any user including root, enabling complete authentication bypass and privilege escalation across all services using MUNGE for authentication.
Likely Case
Local attacker extracts cryptographic keys and forges credentials to impersonate users, gaining unauthorized access to services and systems that trust MUNGE authentication.
If Mitigated
With proper network segmentation and least privilege access controls, impact is limited to the local system where exploitation occurs.
🎯 Exploit Status
Exploitation requires local access to send crafted messages to munged. The vulnerability is well-documented with technical details available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.5.18
Vendor Advisory: https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh
Restart Required: Yes
Instructions:
1. Download MUNGE 0.5.18 from official repository. 2. Stop munged service: 'systemctl stop munged'. 3. Install new version using package manager or compile from source. 4. Restart munged: 'systemctl start munged'. 5. Verify service is running and using new version.
🔧 Temporary Workarounds
Restrict local access to munged socket
linuxLimit which users can communicate with munged by adjusting socket permissions
chmod 700 /var/run/munge/munge.socket.2
chown munge:munge /var/run/munge/munge.socket.2
🧯 If You Can't Patch
- Implement strict access controls to limit which users have local shell access to systems running munged
- Monitor for unusual authentication patterns or credential usage in services relying on MUNGE
🔍 How to Verify
Check if Vulnerable:
Check MUNGE version: 'munge --version' or 'rpm -q munge' or 'dpkg -l | grep munge'. If version is between 0.5 and 0.5.17 inclusive, system is vulnerable.Check Version:
munge --versionVerify Fix Applied:
After patching, verify version is 0.5.18 or higher: 'munge --version'. Test authentication with 'munge -n | unmunge' to ensure service is functioning.📡 Detection & Monitoring
Log Indicators:
- Unusual munged process crashes or restarts
- Failed authentication attempts followed by successful authentication from same source
- Large or malformed messages sent to munged socket
Network Indicators:
- Local connections to munged socket from unexpected users or processes
SIEM Query:
source="munged.log" AND ("segmentation fault" OR "buffer overflow" OR "invalid message")🔗 References
- https://github.com/dun/munge/commit/bf40cc27c4ce8451d4b062c9de0b67ec40894812
- https://github.com/dun/munge/releases/tag/munge-0.5.18
- https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh
- http://www.openwall.com/lists/oss-security/2026/02/10/3
- http://www.openwall.com/lists/oss-security/2026/02/17/6
- https://lists.debian.org/debian-lts-announce/2026/02/msg00015.html
