EUVD-2026-63245
GHSA-g67c-jg9c-rqh2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid AD user credentials in trusted domain
-
DeliverySend crafted Kerberos TGS request with forged PAC to FreeIPA KDC
-
ExploitImpersonate privileged FreeIPA principal in unverified PAC data
-
ExecutionPresent forged service ticket to FreeIPA portal, LDAP, or SMB service
-
ImpactGain elevated privileges within FreeIPA domain
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Two specific conditions must be simultaneously present: (1) an explicitly configured cross-realm trust relationship between FreeIPA and an Active Directory domain - this is a non-default administrative configuration that must be deliberately established; and (2) an authenticated Active Directory account in the trusted AD domain (reflected in CVSS PR:L). FreeIPA deployments without any AD trust relationship are completely unaffected regardless of version. Exploitation is limited to network-reachable FreeIPA services: the web management portal, the Samba-based SMB server, and the 389 Directory Server LDAP interface. No user interaction on the FreeIPA side is required. Attack complexity is low once the trust exists because PAC validation is simply absent rather than bypassable through a complex technique. Limiting factors: the attacker must already possess a valid AD credential in the trusted domain, and the organization must have deployed the specific cross-realm trust configuration. |
| Impact | The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network-accessible exploitation requiring only a low-privilege AD account, with high confidentiality and integrity impact. However, several signals moderate real-world urgency significantly. EPSS is very low at 0.20% (10th percentile), indicating the security community does not currently expect widespread exploitation. The vulnerability is not in CISA KEV and no public exploit code has been identified. SSVC rates Exploitation as 'none' and Automatable as 'no,' meaning automated mass scanning is unlikely and exploitation requires deliberate, targeted effort. The critical moderating factor is the prerequisite of a configured AD-FreeIPA cross-realm trust - a non-default deployment choice that dramatically reduces the exposed population. Organizations running standalone FreeIPA without AD integration are entirely unaffected. For those with AD trusts, however, the SSVC 'total' technical impact rating is warranted given that a successful attacker gains privileged access to core identity services (LDAP, portal, SMB). This should be treated as high priority for organizations with AD trusts, and low priority for all others. |
| Exploit ScenarioDerived | An attacker holding a valid account in an Active Directory domain trusted by FreeIPA constructs a Kerberos TGS request that includes a manipulated PAC asserting membership in a high-privilege FreeIPA group or impersonating a FreeIPA administrator principal. Because FreeIPA services do not verify the PAC certificate, the forged ticket is accepted, and the attacker gains elevated access to FreeIPA's LDAP directory, web portal, or SMB server with the privileges of the impersonated identity. No public exploit code has been identified at time of analysis, and exploitation requires knowledge of FreeIPA's Kerberos trust implementation and PAC structure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 24, 2026
FreeIPA's Kerberos Ticket Granting Service fails to verify Privilege Attribute Certificate (PAC) signatures when processing cross-realm tickets from a trusted Active Directory domain, allowing any authenticated AD user to impersonate arbitrary FreeIPA principals. This grants unauthorized elevated access to FreeIPA services including the web portal, SMB server, and LDAP directory. No active exploitation is confirmed (not in CISA KEV; SSVC Exploitation: none), though SSVC rates technical impact as total and CVSS scores 8.1 - the gap reflects the non-default trust configuration prerequisite that limits real-world exposure.
Earlier versions of this analysis (1)
Authentication bypass and privilege escalation in FreeIPA (as shipped in Red Hat Enterprise Linux 6 through 10) allows an authenticated Active Directory user to impersonate arbitrary FreeIPA principals when an IPA-AD trust is configured. Because FreeIPA services fail to validate the Privilege Attribute Certificate (PAC) in Ticket Granting Service (TGS) tickets, an attacker can forge a client name and gain unauthorized access to the IPA web portal, SMB server, and LDAP directory. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.6 scope-changing rating reflects the severe cross-domain impact.
RemediationAI
No specific patched FreeIPA package version has been confirmed in the available data - patch availability and exact fix versions must be verified directly through the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11861 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2487472; apply available RHEL FreeIPA package updates as soon as a fix is released. As an immediate compensating control, audit and restrict which Active Directory users and groups are permitted within the cross-realm trust to the absolute minimum necessary, reducing the pool of accounts that could be weaponized. Enforcing additional authentication factors (such as OTP) on the FreeIPA web portal limits portal-level escalation, though it does not address the SMB or LDAP attack surfaces. Deploying Kerberos audit logging on the FreeIPA KDC to flag anomalous cross-realm TGS requests can provide detection capability. Removing the AD trust entirely eliminates the attack surface completely but will disrupt all cross-domain authentication workflows and should only be done after assessing operational impact.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FreeIPA is an integrated identity management suite for Linux and Unix environments, bundling MIT Kerberos, 389 Directory Server (LDAP), Dogtag Certificate System, and DNS. When a cross-realm trust is established with Active Directory, FreeIPA participates in Kerberos ticket exchanges that include Microsoft's Privilege Attribute Certificate (PAC) extension (defined in MS-PAC), which carries authorization data such as group SIDs and privilege assignments. CWE-266 (Incorrect Privilege Assignment) applies: FreeIPA services in the trust code path do not validate PAC certificates embedded in TGS tickets, meaning the PAC's claimed identity and group memberships are trusted without cryptographic verification. An attacker can therefore forge or manipulate PAC data to assert a privileged FreeIPA principal identity using a legitimately issued AD Kerberos ticket as the carrier.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable FreeIPA services accept forged PAC tickets from any authenticated AD user (PR:L); no interaction or elevated complexity is required beyond the trust configuration prerequisite, and no availability impact is described.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.
Executive ViewAI
FreeIPA's Kerberos ticket validation fails for cross-realm Active Directory domains, allowing authenticated AD users to impersonate FreeIPA principals and gain unauthorized elevated access to directory services and administrative portals (CVSS 8.1). No public exploit identified at time of analysis, but organizations with AD cross-realm trusts face elevated risk of directory compromise.
Pending patch availability: (1) enforce Privilege Attribute Certificate validation policies to reject malformed or suspicious cross-realm tickets; (2) implement role-based access controls within FreeIPA to limit the scope of AD-derived principals; (3) enable comprehensive Kerberos event logging and set up alerts for suspicious ticket validation failures; (4) consider disabling AD trust relationships if not essential to operations; (5) implement additional authentication factors for access to sensitive FreeIPA administrative services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Exploit-DB