The Kerberos Hub agent sends its private and public keys in custom HTTP headers to a configured Hub URI. The HTTP client used in the upload function follows redirects automatically without a CheckRedirect policy. Go's net/http client strips only standard sensitive headers on cross-host redirects but does not remove custom headers like X-Kerberos-Hub-PrivateKey. If the Hub URI responds with a cross-host redirect (e.g., 302 Found) to an attacker-controlled domain, the private key is forwarded to that domain, leaking a long-lived secret. This secret enables the attacker to impersonate the agent and upload data to the Kerberos Hub. The vulnerability arises from operator-configured Hub URIs and the lack of redirect header sanitization in the client code.

The private key used for authenticating the agent to the Kerberos Hub can be exfiltrated to an attacker-controlled host if the configured Hub URI issues a cross-origin redirect. This compromises the confidentiality of the agent's credentials and allows attackers to impersonate the device, potentially uploading malicious or unauthorized data to the Kerberos Hub. The impact depends on the operator's Hub URI configuration and the presence of redirects to malicious hosts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, operators should ensure that the configured Hub URI does not issue cross-host redirects. Avoid using Hub URIs that could be subject to open redirects or DNS/BGP hijacking. Implement manual redirect handling that strips sensitive custom headers on cross-host redirects or disable automatic redirect following in the HTTP client.