CVE-2024-10394: Theft of credentials in Unix client PAGs

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-14 · updated 2026-06-17
Weakness: CWE-305

Description

A local user can bypass the OpenAFS PAG (Process Authentication Group) throttling mechanism in Unix clients, allowing the user to create a PAG using an existing id number, effectively joining the PAG and letting the user steal the credentials in that PAG.

Affected products

The OpenAFS Foundation OpenAFS: from 1.0 before 1.6.25; from 1.8.0 before 1.8.13; 1.9.0 — fixed in 1.6.25, 1.8.13

How to fix

Upgrade to a fixed version: The OpenAFS Foundation OpenAFS 1.6.25, 1.8.13. Check the vendor advisory for mitigations.

References

https://www.openafs.org/pages/security/OPENAFS-SA-2024-001.txt
https://www.openafs.org/security
https://lists.debian.org/debian-lts-announce/2025/05/msg00019.html

Get alerted when CVE-2024-10394 or the next vulnerability affects your stack