Vulnerabilities

CVE-2026-13097 is a privilege escalation in FreeIPA caused by the uniqueness constraint on Kerberos principal name attributes in the 389-ds directory server failing to treat equivalent representations of the same principal name as duplicates (CWE-706, incorrectly-resolved name/reference). A user with sufficient LDAP write privileges can exploit this by creating a service principal whose name is an alternate but equivalent form of an existing privileged principal, bypassing the uniqueness check. The attacker can then acquire Kerberos service tickets for sensitive services as the impersonated principal, potentially achieving full domain compromise; the flaw scores 8.7 (high) on CVSS 3.1 with a scope change from the directory server to the Kerberos realm. Affected organizations are those running FreeIPA (Red Hat Enterprise Linux IdM) with 389-ds directory services. No exploitation is known at this time, no public proof-of-concept exists, and the flaw is not in CISA KEV; EPSS puts 30-day exploitation probability at 0.3% (19th percentile), though related FreeIPA flaw-chain research (anonymous clients creating reusable administrator credentials) has drawn attention to the product.

Do: Monitor Red Hat advisories and upgrade 389-ds-base and freeipa/IdM packages to the fixed releases for your RHEL version as soon as they are published, since no fixed version numbers are listed in the current data. Until patched, restrict LDAP write privileges on Kerberos principal name attributes to the minimum set of roles, and audit the directory for existing principals whose names are case- or format-equivalent variants of privileged principals (e.g., admin, kadmin, host and service principals). Given the related FreeIPA flaw-chain research on anonymous clients obtaining reusable administrator credentials, also review anonymous/simple-bind directory access and apply any companion FreeIPA fixes.

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.