diff --git a/lib/krb5/acl.c b/lib/krb5/acl.c
index 3fe3e337d..6f9eae8b7 100644
--- a/lib/krb5/acl.c
+++ b/lib/krb5/acl.c
@@ -263,6 +263,7 @@ krb5_acl_match_file(krb5_context context,
 			       strerror(save_errno));
 	return save_errno;
     }
+    rk_cloexec_file(f);
 
     va_start(ap, format);
     ret = acl_parse_format(context, &acl, format, ap);