FreeIPA Vulnerability Chain Grants an Anonymous Client Administrator Rights

Red Hat has disclosed a critical vulnerability chain in FreeIPA — the system that governs access across a Linux domain and stores every account in a 389 Directory Server database reachable over LDAP. The issue (CVE-2026-76578, preliminary CVSS score 9.8) lets a client that has never authenticated create a Kerberos identity of its own choosing in the directory and end up in the administrators group. Red Hat's engineers report that they reproduced the attack twice against a default installation, the last time from a machine that had no access at all.

How the chain fires

FreeIPA ships an access control rule (ACI) that lets a user manage their own one-time token. This rule requires no login and places no limit on what else can be written alongside the token. On its own this is not dangerous — but then the second defect comes into play.

389 Directory Server has a rule type that is meant to signify “only the authenticated owner of the record.” It compares the client's name against the stored value as ordinary text, and for an unauthenticated client the name is empty — which matches the empty stored value. As a result, an anonymous client creates a token record with the owner fields left blank, passes the check “as nobody,” and writes a Kerberos identity with a password alongside it.

The directory defect (CVE-2026-76560, score 7.5) Red Hat attributes to the access control engine itself: it was reproduced on a clean 389-ds build without FreeIPA, while a control test with a non-empty value was correctly rejected. It is only dangerous where a rule of this form is deployed — and FreeIPA ships exactly such a rule by default.

An earlier fix for CVE-2026-13097 closed off the ability to forge the real admin account, but left the unauthenticated record as such: the attack now works under a name chosen by the attacker, leading, according to Red Hat, to the same outcome. The FreeIPA project itself frames the result more cautiously — as a “stepping stone” to administrative privileges, provided the injected identity does not yet exist.

A second, separate vulnerability

Disclosed at the same time is an issue unrelated to the chain, CVE-2026-79678 (score 8.1). The idp-add command passes two user-supplied values into a Python eval() call, and does so before the permission check, so any account can reach the code. Arbitrary code execution is blocked by a parenthesis filter, but an attacker can read the process's environment variables one at a time by watching for errors — and in containerized installations those may still hold the Directory Manager and administrator passwords set at first startup.

What to do

Both FreeIPA vulnerabilities are fixed in version 4.13.4. Separate advisories have been released for 389-ds-base on RHEL, while the ipa packages had not yet received fixes as of the September 8 check. Until the patches are installed, Red Hat advises restricting LDAP access (ports 389 and 636) to trusted hosts and, after checking dependencies, disabling anonymous binds. There is no workaround for the idp-add defect — only the patch will do. No signs of exploitation in real-world attacks have been observed so far.

Source: The Hacker News