Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., "sudo", "wheel", "docker", "adm") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20658-1 advisory.

    Update to version 2.3.9+git0.a9fd29b.

    Security issues fixed:

    - CVE-2026-34397: Fixed naming collision that can lead to local privilege escalation (bsc#1261324).

    Other updates and bugfixes:

    - update aws-lc-sys to 0.39.0 for security fixes
    - update rustls-webpki to 0.103.10 for CRL revocation fix
    - Version 2.3.9:
      * packaging: fix if/else block for debian's postrm
      * Update apparmor.unix-chkpwd.local (Issue #1252)
      * When Hello user encounters SSPR demand, be permissive
      * add tests for sudo_groups functionality
      * Fix config tests to ignore local host config
      * Do not clear $NOTIFY_SOCKET when calling sd_ready
      * Fix token cache 24h purge
      * broker: use SSO server nonce for PRT only when provided
      * Fix pam_himmelblau blocking local user password changes (#1199)
      * Remove unused File import
      * Use is_ascii_alphanumeric() for account_id validation
      * Fix path traversal in LoadProfilePhoto AccountsService writes
      * Drop initialization tracing span
      * himmelblau-hsm-pin-init: drop RemainAfterExit=yes
      * Add fallback behavior when consent is required
      * qr-greeter: enable extension without socket noise
      * debian: make install/remove noninteractive; reduce QR postinst noise; soften missing hello prt
      * Never respond with BadRequest without error detail
      * deps(rust): bump the all-cargo-updates group across 1 directory with 7 updates

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:21437-1 advisory.

    Update to version 2.3.9+git0.a9fd29b.

    Security issues fixed:

    - CVE-2026-34397: Fixed naming collision that can lead to local privilege escalation (bsc#1261324).

    Other updates and bugfixes:

    - update aws-lc-sys to 0.39.0 for security fixes
    - update rustls-webpki to 0.103.10 for CRL revocation fix
    - Version 2.3.9:
      * packaging: fix if/else block for debian's postrm
      * Update apparmor.unix-chkpwd.local (Issue #1252)
      * When Hello user encounters SSPR demand, be permissive
      * add tests for sudo_groups functionality
      * Fix config tests to ignore local host config
      * Do not clear $NOTIFY_SOCKET when calling sd_ready
      * Fix token cache 24h purge
      * broker: use SSO server nonce for PRT only when provided
      * Fix pam_himmelblau blocking local user password changes (#1199)
      * Remove unused File import
      * Use is_ascii_alphanumeric() for account_id validation
      * Fix path traversal in LoadProfilePhoto AccountsService writes
      * Drop initialization tracing span
      * himmelblau-hsm-pin-init: drop RemainAfterExit=yes
      * Add fallback behavior when consent is required
      * qr-greeter: enable extension without socket noise
      * debian: make install/remove noninteractive; reduce QR postinst noise; soften missing hello prt
      * Never respond with BadRequest without error detail
      * deps(rust): bump the all-cargo-updates group across 1 directory with 7 updates

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1361-1 advisory.

    Update to version 2.3.9+git0.a9fd29b; (jsc#PED-14511):

    - CVE-2026-34397: Fix LPE due to name collision during NSS fake-primary group lookup (bsc#1261324).
    - CVE-2026-31979: Fix race condition when accessiung /tmp/krb5cc_uid (bsc#1259548).
    - CVE-2026-25727: deps(rust): Bump the `all-cargo-updates` group with 8 updates (bsc#1257904).
    - CVE-2025-58160: deps(rust): Bump `tracing-subscriber` in the cargo group (bsc#1249013).
    - CVE-2025-54882: Fix Kerberos credential cache permissions (bsc#1247735).
    - CVE-2025-53013: Fix permitted authentication with invalid Hello PIN (bsc#1245437).
    - CVE-2024-11738: Fix `rustls` network-reachable panic in `Acceptor::accept` (bsc#1233949).

    Other bug fixes:

    - Fix SELinux module packaging to use standard policy macros (bsc#1258236).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
312143	openSUSE 16 Security Update : himmelblau (openSUSE-SU-2026:20658-1)	Nessus	SuSE Local Security Checks	high
312122	SUSE SLES16 Security Update : himmelblau (SUSE-SU-2026:21437-1)	Nessus	SuSE Local Security Checks	high
306681	SUSE SLED15: himmelblau / himmelblau-sshd-config / libnss_himmelblau2 / etc (SUSE-SU-2026:1361-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2026-34397

high

Tenable Plugins

high

high

medium