CVE-2022-26110

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-06 · updated 2026-06-17

Description

An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, and 9.1.x before 9.6.0. When a user authenticates to an HTCondor daemon via the CLAIMTOBE method, the user can then impersonate any entity when issuing additional commands to that daemon.

Affected products

Debian Linux: 9.0, 10.0
HTCondor: from 8.8.0 before 8.8.16; from 9.0.0 before 9.0.10; from 9.1.0 before 9.6.0 — fixed in 8.8.16, 9.0.10, 9.6.0

How to fix

Upgrade to a fixed version: HTCondor 8.8.16, 9.0.10, 9.6.0. Check the vendor advisory for mitigations.

References

https://lists.debian.org/debian-lts-announce/2022/04/msg00016.html
https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0003/
https://www.debian.org/security/2022/dsa-5144
https://lists.debian.org/debian-lts-announce/2022/04/msg00016.html
https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0003/
https://www.debian.org/security/2022/dsa-5144

Get alerted when CVE-2022-26110 or the next vulnerability affects your stack