Eval injection in FreeIPA idp-add leaks server environment variables and enables DoS
AI analysis
CVE-2026-79678 is an eval-injection flaw (CWE-95) in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input is passed to a constrained eval() call. Because the LDAP access control check that should gate this operation is only enforced after eval() runs, any authenticated IPA principal can trigger it, with no administrative privilege required. An attacker gains the ability to enumerate and read the environment variables of the affected server process, which may contain sensitive values such as service credentials, and can also exhaust process memory to cause denial of service. Affected systems are FreeIPA identity-management servers, though the vulnerable and fixed version ranges were not included in the available data (the flaw is coordinated by Red Hat, which distributes FreeIPA in RHEL and related platforms). There is currently no known public proof-of-concept, the CVE is not in CISA's KEV catalog, EPSS puts 30-day exploitation probability at 0.5% (39th percentile), and no confirmed exploitation is known; separate headline coverage of a FreeIPA flaw chain allowing anonymous clients to mint reusable administrator credentials describes related but distinct FreeIPA news, not this CVE.
What to do: Apply the FreeIPA/RHEL errata for CVE-2026-79678 as soon as patched packages are published (fixed version numbers are not stated in the available data, so consult the Red Hat and upstream FreeIPA advisories). Until then, reduce risk by limiting which hosts and users can reach the IPA masters' API, keeping secrets out of the environment of IPA service processes (e.g., systemd Environment/EnvironmentFile settings), and monitoring IPA servers for abnormal memory consumption. Review the process environment of ipa-related services for sensitive values and check IPA logs for unexpected idp-add invocations by non-privileged principals.
Affected
| Red Hat / FreeIPA project FreeIPA (idp-add command, IPA command-line/API server) | — |
Estimated exposure
largetens of thousands of FreeIPA servers in aggregate (estimated; no public install-base counts) — FreeIPA is the standard identity-management component shipped with RHEL, Fedora, and related distributions and is commonly deployed as small server clusters in Linux-centric enterprises, which implies an aggregate in the tens of thousands…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.