Vulnerability · Published Nov 12, 2025 · Assigned by redhat

CVE-2025-59088Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv

High 8.6

In plain English

A high-severity server-side request forgery in kdcproxy from latchset. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the "use_dns" setting is explicitly set to false are not affected.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	bind-dyndb-ldap	11.6-6.module_el8.10.0+3980+d78e8e90	ALSA-2025:21140
AlmaLinux:8	bind-dyndb-ldap	11.6-6.module_el8.10.0+3980+d78e8e90	ALSA-2026:83460
AlmaLinux:8	custodia	0.6.0-3.module_el8.6.0+2881+2f24dc92	ALSA-2026:83460
AlmaLinux:8	custodia	0.6.0-3.module_el8.6.0+2881+2f24dc92	ALSA-2025:21140
AlmaLinux:8	ipa-client	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	ipa-client	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	ipa-client-common	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	ipa-client-common	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	ipa-client-epn	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	ipa-client-epn	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	ipa-client-samba	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	ipa-client-samba	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	ipa-common	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	ipa-common	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	ipa-healthcheck	0.12-6.module_el8.10.0+4036+84b152d9	ALSA-2026:83460
AlmaLinux:8	ipa-healthcheck	0.12-6.module_el8.10.0+4036+84b152d9	ALSA-2025:21140
AlmaLinux:8	ipa-healthcheck-core	0.12-6.module_el8.10.0+4036+84b152d9	ALSA-2026:83460
AlmaLinux:8	ipa-healthcheck-core	0.12-6.module_el8.10.0+4036+84b152d9	ALSA-2025:21140
AlmaLinux:8	ipa-python-compat	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	ipa-python-compat	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	ipa-selinux	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	ipa-selinux	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	ipa-server	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	ipa-server	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	ipa-server-common	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	ipa-server-common	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	ipa-server-dns	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	ipa-server-dns	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	ipa-server-trust-ad	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	ipa-server-trust-ad	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	opendnssec	2.1.7-2.module_el8.10.0+3980+d78e8e90	ALSA-2026:83460
AlmaLinux:8	opendnssec	2.1.7-2.module_el8.10.0+3980+d78e8e90	ALSA-2025:21140
AlmaLinux:8	python3-custodia	0.6.0-3.module_el8.6.0+2881+2f24dc92	ALSA-2025:21140
AlmaLinux:8	python3-custodia	0.6.0-3.module_el8.6.0+2881+2f24dc92	ALSA-2026:83460
AlmaLinux:8	python3-ipaclient	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	python3-ipaclient	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	python3-ipalib	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	python3-ipalib	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	python3-ipaserver	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	python3-ipaserver	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	python3-ipatests	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:21140
AlmaLinux:8	python3-ipatests	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:8	python3-jwcrypto	0.5.0-2.module_el8.10.0+3844+20e075e5	ALSA-2025:21140
AlmaLinux:8	python3-jwcrypto	0.5.0-2.module_el8.10.0+3844+20e075e5	ALSA-2026:83460
AlmaLinux:10	python3-kdcproxy	1.0.0-19.el10_1	ALSA-2025:21142
AlmaLinux:8	python3-kdcproxy	0.4-5.module_el8.10.0+4069+1d9eaa78.2	ALSA-2026:83460
AlmaLinux:8	python3-kdcproxy	0.4-5.module_el8.10.0+4069+1d9eaa78.2	ALSA-2025:21140
AlmaLinux:9	python3-kdcproxy	1.0.0-9.el9_7	ALSA-2025:21139
AlmaLinux:8	python3-pyusb	1.0.0-9.1.module_el8.7.0+3349+cfeff52e	ALSA-2025:21140
AlmaLinux:8	python3-pyusb	1.0.0-9.1.module_el8.7.0+3349+cfeff52e	ALSA-2026:83460
AlmaLinux:8	python3-qrcode	5.3-1.module_el8.10.0+3942+63b39a46	ALSA-2025:21140
AlmaLinux:8	python3-qrcode	5.3-1.module_el8.10.0+3942+63b39a46	ALSA-2026:83460
AlmaLinux:8	python3-qrcode-core	5.3-1.module_el8.10.0+3942+63b39a46	ALSA-2025:21140
AlmaLinux:8	python3-qrcode-core	5.3-1.module_el8.10.0+3942+63b39a46	ALSA-2026:83460
AlmaLinux:8	python3-yubico	1.3.2-9.1.module_el8.7.0+3349+cfeff52e	ALSA-2026:83460
AlmaLinux:8	python3-yubico	1.3.2-9.1.module_el8.7.0+3349+cfeff52e	ALSA-2025:21140
AlmaLinux:8	slapi-nis	0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1	ALSA-2026:83460
AlmaLinux:8	slapi-nis	0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1	ALSA-2025:21140
AlmaLinux:8	softhsm	2.6.0-5.module_el8.6.0+2881+2f24dc92	ALSA-2025:21140
AlmaLinux:8	softhsm	2.6.0-5.module_el8.6.0+3031+2f24dc92	ALSA-2026:83460
AlmaLinux:8	softhsm	2.6.0-5.module_el8.6.0+3031+2f24dc92	ALSA-2025:21140
AlmaLinux:8	softhsm	2.6.0-5.module_el8.6.0+2881+2f24dc92	ALSA-2026:83460
AlmaLinux:8	softhsm-devel	2.6.0-5.module_el8.6.0+3031+2f24dc92	ALSA-2025:21140
AlmaLinux:8	softhsm-devel	2.6.0-5.module_el8.6.0+2881+2f24dc92	ALSA-2026:83460
AlmaLinux:8	softhsm-devel	2.6.0-5.module_el8.6.0+3031+2f24dc92	ALSA-2026:83460
AlmaLinux:8	softhsm-devel	2.6.0-5.module_el8.6.0+2881+2f24dc92	ALSA-2025:21140
Debian:12	python-kdcproxy	no fix listed	DEBIAN-CVE-2025-59088
Debian:13	python-kdcproxy	no fix listed	DEBIAN-CVE-2025-59088
Debian:14	python-kdcproxy	no fix listed	DEBIAN-CVE-2025-59088
Rocky Linux:8	bind-dyndb-ldap	0:11.6-6.module+el8.10.0+1960+1ed527b3	RLSA-2025:21140
Rocky Linux:8	custodia	0:0.6.0-3.module+el8.9.0+1371+ffa84eb9	RLSA-2025:21140
Rocky Linux:8	ipa	0:4.9.13-20.module+el8.10.0+2067+377bdd64	RLSA-2025:21140
Rocky Linux:8	ipa	0:4.9.13-20.module+el8.10.0+2066+d74ade98	RLSA-2025:21140
Rocky Linux:8	ipa-healthcheck	0:0.12-6.module+el8.10.0+2054+aa003774	RLSA-2025:21140
Rocky Linux:8	ipa-healthcheck	0:0.12-6.module+el8.10.0+2053+a0a9dc19	RLSA-2025:21140
Rocky Linux:8	opendnssec	0:2.1.7-2.module+el8.10.0+1960+1ed527b3	RLSA-2025:21140
Rocky Linux:8	python-jwcrypto	0:0.5.0-2.module+el8.10.0+1818+2dfda7a6	RLSA-2025:21140
Rocky Linux:8	python-jwcrypto	0:0.5.0-2.module+el8.10.0+1819+0aeba2f1	RLSA-2025:21140
Rocky Linux:10	python-kdcproxy	0:1.0.0-19.el10_1	RLSA-2025:21142
Rocky Linux:8	python-kdcproxy	0:0.4-5.module+el8.10.0+2094+d7886766.2	RLSA-2025:21140
Rocky Linux:8	python-kdcproxy	0:0.4-5.module+el8.9.0+1371+ffa84eb9	RLSA-2025:21140
Rocky Linux:8	python-kdcproxy	0:0.4-5.module+el8.10.0+1915+3c70f7d9.1	RLSA-2025:21140
Rocky Linux:9	python-kdcproxy	0:1.0.0-9.el9_7	RLSA-2025:21139
Rocky Linux:8	python-qrcode	0:5.3-1.module+el8.10.0+1916+6bb8cf6b	RLSA-2025:21140
Rocky Linux:8	python-qrcode	0:5.3-1.module+el8.10.0+1915+3c70f7d9	RLSA-2025:21140
Rocky Linux:8	python-yubico	0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9	RLSA-2025:21140
Rocky Linux:8	python-yubico	0:1.3.2-9.1.module+el8.9.0+1372+09f67869	RLSA-2025:21140
Rocky Linux:8	pyusb	0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9	RLSA-2025:21140
Rocky Linux:8	pyusb	0:1.0.0-9.1.module+el8.9.0+1372+09f67869	RLSA-2025:21140
Rocky Linux:8	slapi-nis	0:0.60.0-4.module+el8.9.0+1573+39ab85f4	RLSA-2025:21140
Rocky Linux:8	softhsm	0:2.6.0-5.module+el8.9.0+1371+ffa84eb9	RLSA-2025:21140
Ubuntu:22.04:LTS	python-kdcproxy	no fix listed	UBUNTU-CVE-2025-59088
Ubuntu:24.04:LTS	python-kdcproxy	no fix listed	UBUNTU-CVE-2025-59088
Ubuntu:25.10	python-kdcproxy	no fix listed	UBUNTU-CVE-2025-59088
Ubuntu:26.04:LTS	python-kdcproxy	no fix listed	UBUNTU-CVE-2025-59088
Ubuntu:26.10	python-kdcproxy	no fix listed	UBUNTU-CVE-2025-59088

Affected products (as reported)

Vendor	Product	Versions
latchset	kdcproxy	0 – before 1.1.0
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	see references

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

RHSA-2025:21138 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21139 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21140 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21141 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21142 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21448 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21748 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21806 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21818 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21819 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21820 vendor-advisory, x_refsource_REDHAT
RHSA-2025:21821 vendor-advisory, x_refsource_REDHAT
RHSA-2025:22982 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-59088 vdb-entry, x_refsource_REDHAT
RHBZ#2393955 issue-tracking, x_refsource_REDHAT
https://github.com/latchset/kdcproxy/pull/68