FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials
Critical FreeIPA flaw chain (CVE-2026-76578, CVSS 9.8) lets anonymous clients create reusable admin credentials on default installs; fixed in 4.13.4.
Red Hat warns that chaining FreeIPA's CVE-2026-76578 (CVSS 9.8) with a 389 Directory Server flaw (CVE-2026-76560, CVSS 7.5) lets an anonymous client write a Kerberos identity into the directory and land in the administrators group on default installations; Red Hat reproduced the chain twice, including on a machine with no access at all. FreeIPA 4.13.4 fixes both flaws, and fourteen 389-ds advisories shipped September 8, with RHSA-2026:64785 rated critical. A separate flaw, CVE-2026-79678 (CVSS 8.1), allows reading the server's environment variables one at a time via a Python eval() in idp-add, potentially exposing Directory Manager and administrator passwords in container installs. No real-world exploitation has been reported.
- CVE-2026-76578 plus 389-ds flaw yields anonymous administrator credentials
- Chain works against stock default FreeIPA installs; fixed in 4.13.4
- CVE-2026-79678 leaks environment variables via idp-add eval()
- Earlier CVE-2026-13097 fix blocks impersonating existing accounts only
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-13097 | Kerberos Principal Impersonation Privilege Escalation in FreeIPA (389-ds) | 8.7 | <1% | ||
| CVE-2026-76560 | Authorization bypass in 389 Directory Server lets anonymous clients satisfy SELFDN ACIs | 7.5 | <1% | ||
| CVE-2026-76578 | Unauthenticated privilege-escalation chain in FreeIPA OTP token ACI | 9.8 | 1% | PoC | |
| CVE-2026-79678 | Eval injection in FreeIPA idp-add leaks server environment variables and enables DoS | 8.1 | <1% |
From the original article
6 min read at thehackernews.com
A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group, Red Hat says. FreeIPA is the system that determines who may log in across a Linux domain and maintains all identities in a 389 Directory Server database accessed via LDAP. The attack needs a second flaw in that database software.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.