FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials
Critical FreeIPA flaw chain (CVE-2026-76578, CVSS 9.8) lets anonymous clients create reusable admin credentials on default installs; fixed in 4.13.4.
Red Hat warns that chaining FreeIPA's CVE-2026-76578 (CVSS 9.8) with a 389 Directory Server flaw (CVE-2026-76560, CVSS 7.5) lets an anonymous client write a Kerberos identity into the directory and land in the administrators group on default installations; Red Hat reproduced the chain twice, including on a machine with no access at all. FreeIPA 4.13.4 fixes both flaws, and fourteen 389-ds advisories shipped September 8, with RHSA-2026:64785 rated critical. A separate flaw, CVE-2026-79678 (CVSS 8.1), allows reading the server's environment variables one at a time via a Python eval() in idp-add, potentially exposing Directory Manager and administrator passwords in container installs. No real-world exploitation has been reported.
- CVE-2026-76578 plus 389-ds flaw yields anonymous administrator credentials
- Chain works against stock default FreeIPA installs; fixed in 4.13.4
- CVE-2026-79678 leaks environment variables via idp-add eval()
- Earlier CVE-2026-13097 fix blocks impersonating existing accounts only
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-13097 | Kerberos Principal Impersonation Privilege Escalation in FreeIPA (389-ds) CVE-2026-13097 is a privilege escalation in FreeIPA caused by the uniqueness constraint on Kerberos principal name attributes in the 389-ds directory server failing to treat equivalent representations of the same principal name as duplicates (CWE-706, incorrectly-resolved name/reference). A user with sufficient LDAP write privileges can exploit this by creating a service principal whose name is an alternate but equivalent form of an existing privileged principal, bypassing the uniqueness check. The attacker can then acquire Kerberos service tickets for sensitive services as the impersonated principal, potentially achieving full domain compromise; the flaw scores 8.7 (high) on CVSS 3.1 with a scope change from the directory server to the Kerberos realm. Affected organizations are those running FreeIPA (Red Hat Enterprise Linux IdM) with 389-ds directory services. No exploitation is known at this time, no public proof-of-concept exists, and the flaw is not in CISA KEV; EPSS puts 30-day exploitation probability at 0.3% (19th percentile), though related FreeIPA flaw-chain research (anonymous clients creating reusable administrator credentials) has drawn attention to the product. Do: Monitor Red Hat advisories and upgrade 389-ds-base and freeipa/IdM packages to the fixed releases for your RHEL version as soon as they are published, since no fixed version numbers are listed in the current data. Until patched, restrict LDAP write privileges on Kerberos principal name attributes to the minimum set of roles, and audit the directory for existing principals whose names are case- or format-equivalent variants of privileged principals (e.g., admin, kadmin, host and service principals). Given the related FreeIPA flaw-chain research on anonymous clients obtaining reusable administrator credentials, also review anonymous/simple-bind directory access and apply any companion FreeIPA fixes. | 8.7 | <1% |
| large≈10,000–100,000 FreeIPA/IdM servers (domain controllers and replicas) across tens of thousands of enterprise deployments | ||
| CVE-2026-76560 | Authorization bypass in 389 Directory Server lets anonymous clients satisfy SELFDN ACIs CVE-2026-76560 is an incorrect-authorization flaw (CWE-863) in the SELFDN ACI bind-rule evaluator of 389 Directory Server, the LDAP directory service shipped with Red Hat Enterprise Linux/Fedora and used as the back end of FreeIPA/Red Hat Identity Management. Because the evaluator wrongly treats an anonymous client's empty bind DN as a match for an empty stored attribute value, an unauthenticated LDAP client can satisfy SELFDN access-control rules that were intended to match a specific authenticated user's identity. A network-adjacent attacker could then perform operations such as adding or modifying directory entries that the ACI was supposed to restrict, producing integrity impacts without authentication (CVSS 3.1: 7.5, C:N/I:H/A:N). Any deployment of 389 Directory Server, including FreeIPA/IdM instances, that uses SELFDN-based ACIs and permits anonymous binds is affected. Exploitation has not been observed (EPSS ~0.4%, not in CISA KEV, no known public PoC), though related reporting describes a FreeIPA flaw chain in which anonymous clients created reusable administrator credentials. Do: Audit ACIs that use SELFDN/userdn bind rules, and restrict anonymous binds (e.g., set nsslapd-allow-anonymous-access to off) until the server is updated. Apply the 389 Directory Server fix from Red Hat/Fedora advisories when released — no fixed version number is stated in the available data, so check the Red Hat Security Advisory for your release. FreeIPA/IdM administrators should also watch for the related FreeIPA flaw chain that enables anonymous creation of reusable administrator credentials and review directory modifications made by anonymous bind DNs. | 7.5 | <1% |
| largeon the order of 10,000–100,000 deployments (exact counts unknown) | ||
| CVE-2026-76578 | Unauthenticated privilege-escalation chain in FreeIPA OTP token ACI FreeIPA's self-managed OTP token access-control rule (ACI) permits anonymous, unauthenticated LDAP access and does not restrict which attributes may be added alongside a token entry. Chained with a separate flaw in the underlying directory server's ACI evaluation (tracked in a different CVE), a remote, unauthenticated LDAP client can create an attacker-controlled Kerberos principal and have it added to the FreeIPA administrators group. The attacker thereby obtains genuine administrator-group membership and can perform administrative operations against the directory and, on deployments with SID support, against other Identity Management services. Any organization running FreeIPA, including Red Hat Enterprise Linux Identity Management deployments, is affected; the available data does not specify affected or fixed version ranges. No public proof of concept, KEV listing, or known in-the-wild exploitation exists, and EPSS estimates a 0.5% probability of exploitation within 30 days. Do: Apply the FreeIPA update from the Red Hat security advisory as soon as a fixed package is released (the data here does not list fixed versions), and also patch the underlying directory server for the companion ACI-evaluation flaw this issue is chained with. Until patched, restrict unauthenticated network access to LDAP on FreeIPA servers (ports 389/636) to trusted networks only, and audit the administrators group and directory audit logs for unexpected principals or recently created Kerberos entries. | 9.8 | <1% | PoC |
| moderateOn the order of tens of thousands of FreeIPA servers across thousands of enterprise deployments, with only a fraction exposed to unauthenticated LDAP; not… | |
| CVE-2026-79678 | Eval injection in FreeIPA idp-add leaks server environment variables and enables DoS CVE-2026-79678 is an eval-injection flaw (CWE-95) in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input is passed to a constrained eval() call. Because the LDAP access control check that should gate this operation is only enforced after eval() runs, any authenticated IPA principal can trigger it, with no administrative privilege required. An attacker gains the ability to enumerate and read the environment variables of the affected server process, which may contain sensitive values such as service credentials, and can also exhaust process memory to cause denial of service. Affected systems are FreeIPA identity-management servers, though the vulnerable and fixed version ranges were not included in the available data (the flaw is coordinated by Red Hat, which distributes FreeIPA in RHEL and related platforms). There is currently no known public proof-of-concept, the CVE is not in CISA's KEV catalog, EPSS puts 30-day exploitation probability at 0.5% (39th percentile), and no confirmed exploitation is known; separate headline coverage of a FreeIPA flaw chain allowing anonymous clients to mint reusable administrator credentials describes related but distinct FreeIPA news, not this CVE. Do: Apply the FreeIPA/RHEL errata for CVE-2026-79678 as soon as patched packages are published (fixed version numbers are not stated in the available data, so consult the Red Hat and upstream FreeIPA advisories). Until then, reduce risk by limiting which hosts and users can reach the IPA masters' API, keeping secrets out of the environment of IPA service processes (e.g., systemd Environment/EnvironmentFile settings), and monitoring IPA servers for abnormal memory consumption. Review the process environment of ipa-related services for sensitive values and check IPA logs for unexpected idp-add invocations by non-privileged principals. | 8.1 | <1% |
| largetens of thousands of FreeIPA servers in aggregate (estimated; no public install-base counts) |
Full article1,283 words · extracted from thehackernews.com · click to collapse
A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group, Red Hat says.
FreeIPA is the system that determines who may log in across a Linux domain and maintains all identities in a 389 Directory Server database accessed via LDAP. The attack needs a second flaw in that database software.
The FreeIPA project has already fixed its side in version 4.13.4. Red Hat says it reproduced the chain twice on a default installation, most recently on a machine with no access at all.
Red Hat tracks the FreeIPA flaw as CVE-2026-76578 and rates it critical, with a CVSS score of 9.8. The same page says that score is preliminary and subject to review.
Red Hat ships FreeIPA as its Identity Management product, where the package is called ipa.
FreeIPA ships an access control rule, called an ACI, that lets a user manage their own one-time-password token. The rule does not require the client to have logged in, nor does it limit what else may be written alongside the token.
That only becomes dangerous because of the second flaw. 389 Directory Server has a rule type meant to say "only the authenticated owner of this entry." It compares the client's name against a stored value as plain text, and a client that has not logged in has an empty name, which matches an empty stored value.
So an anonymous client can create a token entry with the ownership fields left blank, pass the ownership check by being nobody, and write a Kerberos identity and password alongside it.
Red Hat scores the directory-server flaw, CVE-2026-76560, at 7.5, and says Red Hat Directory Server ships no rule of that shape by default. On its own, the flaw matters only where a deployment has written such a rule.
FreeIPA is such a deployment. Its shipped default rule is exactly that shape, which is why the chain works against an untouched install. That connection is our reading of two advisories that describe the halves separately.
Red Hat also reproduced the directory-server defect on its own, on a plain 389-ds build with no FreeIPA parts installed, and a control test using a value that was not empty was correctly refused. That places the defect in the access-control engine rather than in anything FreeIPA does.
The technique first reported to Red Hat impersonated the real admin account by creating a Kerberos name that matched it. An earlier fix for CVE-2026-13097 blocked that collision but left the underlying unauthenticated write in place. The attack now works under a name the attacker picks instead, Red Hat says, "reaching the same practical outcome."
That earlier flaw, fixed in FreeIPA 4.13.3, was a different problem. The check that Kerberos names are unique did not allow different ways of writing the same name, which allowed a user with write access to create a service identity that impersonated an existing privileged one.
The two projects describe the result differently. Red Hat calls it genuine administrator-group membership and reusable administrator credentials.
The FreeIPA project puts it more narrowly, stating that the injected identity must not already exist, that the CVE-2026-13097 fix prevents existing accounts from being taken over, and that the attack "may be used as a stepping stone" to administrative privileges.
Red Hat says it ran the chain against a stock FreeIPA container image running version 4.13.1 and checked the results with standard administrator-only commands rather than trusting the exploit's output. None of the advisories or bug reports describe the flaw being used in a real attack.
For deployments using Windows-style security identifiers, Red Hat says the attacker can also obtain a Kerberos ticket containing authorization data, thereby extending access to the server's HTTP and Dogtag services. Dogtag is FreeIPA's built-in certificate authority.
A Second, Separate Flaw
Red Hat disclosed a second FreeIPA flaw alongside these, CVE-2026-79678, which has nothing to do with the chain above. It rates this one important, with a score of 8.1.
The idp-add command passes two values the caller supplies, an organization name and a base URL, into a Python eval() call. That call runs before the permission check meant to limit the command to identity-provider administrators, so any account on the server can reach it, whatever its privileges.
The call is limited by a pattern that forbids brackets, which stops any function being called. Red Hat says "no code execution is possible."
What an attacker can do is read the server process's environment variables one at a time by observing the error the server returns, and use up the server's memory with a short arithmetic expression.
How much that matters depends on how FreeIPA was installed, Red Hat says. On a normal package-based install, the process environment holds only documented paths and settings. Container installs are different.
The official FreeIPA server image often takes the Directory Manager and administrator passwords as environment variables at first boot, and those passwords could be exposed if they remain after setup finishes.
Red Hat credits Gia Bui of Calif with reporting the FreeIPA chain and the directory-server flaw, and credits Calif working with Anthropic for the idp-add flaw.
What Administrators Can Do Now
The fix has arrived in three different places at three different times, so the answer depends on which piece of software you are patching.
| Component | What to install | State when checked |
|---|---|---|
| FreeIPA, from the project | FreeIPA 4.13.4 | Fixes both FreeIPA flaws. The release notes carry no date and do not say which earlier versions are affected. |
| 389-ds-base on Red Hat Enterprise Linux and Red Hat Directory Server | The advisory for your release |
Fourteen advisories were published on 8 September between 01:56 and 05:07 UTC, listed on the
389-ds bug record.
RHSA-2026:64785
covers Red Hat Enterprise Linux 10 with 389-ds-base-3.2.0-10.el10_2.
The advisory is rated critical and covers four more 389-ds flaws besides this one.
|
ipa packages on Red Hat Enterprise Linux
|
Not listed yet | Red Hat's bug records for both FreeIPA flaws showed no fixed version and no advisory when they were checked on 8 September. |
| 389-ds-base on Fedora | Update still in testing |
The Fedora tracker was marked ON_QA when checked on 8 September.
|
No advisory for plain Red Hat Enterprise Linux 9 appeared in that list of fourteen. That is what the bug record showed on 8 September, not a statement that the release has no fix coming.
Until a fixed package is available, Red Hat gives two temporary steps for the chain:
- Restrict access to the LDAP service (typically ports 389 and 636) to hosts you trust, using firewall rules or network segmentation.
- Turning off anonymous LDAP binds blocks this particular path, Red Hat says, but check first that nothing else in your deployment needs them.
For the idp-add flaw, there is no such option. Red Hat says no configuration setting keeps an ordinary authenticated account away from that code, and that a fixed package is required. It adds that anyone running container installs should verify that the password set at first boot is no longer present in the running process environment.
The published material leaves two questions unanswered. Neither Red Hat nor the FreeIPA project says whether 389-ds updates, on their own, stop the FreeIPA attack on a server whose ipa packages are still outdated.
And neither says whether applying a fix removes an identity an attacker created beforehand, or what an administrator should look for to find out.
Neither the advisories nor the bug reports publish detection rules or indicators.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html