New Kerberos Relay Technique Exploits DNS CNAMEs to Bypass Existing Defenses

This report describes CVE-2026-20929, a critical Windows Kerberos authentication relay vulnerability where attackers who can intercept DNS queries (via ARP/DHCP poisoning or similar MITM techniques) return crafted CNAME/A records to coerce victims into requesting Kerberos service tickets for attacker-controlled SPNs, enabling lateral movement and privilege escalation. The technique's cross-protocol ticket acceptance (e.g., HTTP <> SMB) greatly expands exploitation opportunities. Microsoft acknowledged the behavior and rolled out Channel Binding Token support for HTTP.sys in January 2026, while recommended mitigations include enforcing SMB signing, requiring CBT for HTTP/HTTPS, LDAP signing/LDAPS CBT, and DNS hardening.