CVE-2025-59088VulnerabilityPublished 12 Nov 2025Updated 30 Jun 2026

CVE-2025-59088: latchset kdcproxy · Server-Side Request Forgery (SSRF)

Affects latchset kdcproxySource CVE Database V5

Not known to be exploited · CVSS 8.6 High.

Data as of 26 Oct 2026, 07:57 UTC

CVSS 3.1 base score

8.6High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 41% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 12 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
GitHublatchset/kdcproxy`pkg:github/latchset/kdcproxy`Other threats	Affected =0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A security update fixing this vulnerability is available and should be applied. Red Hat has released patched python-kdcproxy packages for Red Hat Enterprise Linux 9 and 9.6 Extended Update Support and related variants. Deployments can also mitigate the issue by explicitly setting the "use_dns" configuration option to false, which disables the vulnerable DNS SRV record querying behavior. Refer to the Red Hat advisories RHSA-2025:21138 and RHSA-2025:21139 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps.

Description

If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the "use_dns" setting is explicitly set to false are not affected.

Impact

Successful exploitation of this SSRF vulnerability allows unauthenticated remote attackers to perform server-side requests to arbitrary hosts and ports by controlling DNS SRV records for a requested realm. This can lead to internal network reconnaissance, firewall rule probing, port scanning, and potential data exfiltration from internal services. The vulnerability affects confidentiality but does not impact integrity or availability directly. The scope is changed as the attacker can cause the server to make requests to other network resources.

Summary

The kdcproxy component in latchset is vulnerable to an unauthenticated SSRF vulnerability (CVE-2025-59088) due to its default behavior of querying DNS SRV records for realms lacking server address configuration. This allows attackers to supply a realm name that corresponds to a DNS zone they control, with SRV records pointing to arbitrary internal or loopback addresses and ports. Exploitation can reveal internal network topology, firewall rules, enable port scanning, and data exfiltration. The vulnerability is mitigated if the "use_dns" setting is explicitly set to false. Red Hat has issued security advisories and patches for python-kdcproxy in multiple Red Hat Enterprise Linux 9 variants, including Extended Update Support and Update Services for SAP Solutions. The CVSS v3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity with network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact with scope change.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 2 Jul 2026, 22:12 UTC

Technical details

References

Community reviews

Related threats