CVE-2025-59088: Server-Side Request Forgery (SSRF) in latchset kdcproxy
If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the "use_dns" setting is explicitly set to false are not affected.
AI Analysis
Technical Summary
The kdcproxy component in latchset is vulnerable to an unauthenticated SSRF vulnerability (CVE-2025-59088) due to its default behavior of querying DNS SRV records for realms lacking server address configuration. This allows attackers to supply a realm name that corresponds to a DNS zone they control, with SRV records pointing to arbitrary internal or loopback addresses and ports. Exploitation can reveal internal network topology, firewall rules, enable port scanning, and data exfiltration. The vulnerability is mitigated if the "use_dns" setting is explicitly set to false. Red Hat has issued security advisories and patches for python-kdcproxy in multiple Red Hat Enterprise Linux 9 variants, including Extended Update Support and Update Services for SAP Solutions. The CVSS v3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity with network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact with scope change.
Potential Impact
Successful exploitation of this SSRF vulnerability allows unauthenticated remote attackers to perform server-side requests to arbitrary hosts and ports by controlling DNS SRV records for a requested realm. This can lead to internal network reconnaissance, firewall rule probing, port scanning, and potential data exfiltration from internal services. The vulnerability affects confidentiality but does not impact integrity or availability directly. The scope is changed as the attacker can cause the server to make requests to other network resources.
Mitigation Recommendations
A security update fixing this vulnerability is available and should be applied. Red Hat has released patched python-kdcproxy packages for Red Hat Enterprise Linux 9 and 9.6 Extended Update Support and related variants. Deployments can also mitigate the issue by explicitly setting the "use_dns" configuration option to false, which disables the vulnerable DNS SRV record querying behavior. Refer to the Red Hat advisories RHSA-2025:21138 and RHSA-2025:21139 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps.
CVE-2025-59088: Server-Side Request Forgery (SSRF) in latchset kdcproxy
Description
If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the "use_dns" setting is explicitly set to false are not affected.
CVSS v3.1
Score 8.6high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The kdcproxy component in latchset is vulnerable to an unauthenticated SSRF vulnerability (CVE-2025-59088) due to its default behavior of querying DNS SRV records for realms lacking server address configuration. This allows attackers to supply a realm name that corresponds to a DNS zone they control, with SRV records pointing to arbitrary internal or loopback addresses and ports. Exploitation can reveal internal network topology, firewall rules, enable port scanning, and data exfiltration. The vulnerability is mitigated if the "use_dns" setting is explicitly set to false. Red Hat has issued security advisories and patches for python-kdcproxy in multiple Red Hat Enterprise Linux 9 variants, including Extended Update Support and Update Services for SAP Solutions. The CVSS v3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity with network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact with scope change.
Potential Impact
Successful exploitation of this SSRF vulnerability allows unauthenticated remote attackers to perform server-side requests to arbitrary hosts and ports by controlling DNS SRV records for a requested realm. This can lead to internal network reconnaissance, firewall rule probing, port scanning, and potential data exfiltration from internal services. The vulnerability affects confidentiality but does not impact integrity or availability directly. The scope is changed as the attacker can cause the server to make requests to other network resources.
Mitigation Recommendations
A security update fixing this vulnerability is available and should be applied. Red Hat has released patched python-kdcproxy packages for Red Hat Enterprise Linux 9 and 9.6 Extended Update Support and related variants. Deployments can also mitigate the issue by explicitly setting the "use_dns" configuration option to false, which disables the vulnerable DNS SRV record querying behavior. Refer to the Red Hat advisories RHSA-2025:21138 and RHSA-2025:21139 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2025-09-08T21:43:30.845Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2025:21138","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:21139","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:21140","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:21141","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:21142","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:21448","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:21748","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:21806","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:21818","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:21819","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:21820","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:21821","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2025:22982","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2025-59088","vendor":"Red Hat"}]
Threat ID: 6914c133f490e7dc3cc5b76c
Added to database: 11/12/2025, 17:17:39 UTC
Last enriched: 07/02/2026, 22:12:53 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 368
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.