EUVD-2026-63243
GHSA-q4ph-46qc-4w6x
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
LDAP write access is network-delivered but requires high privileges; scope changes because Kerberos ticket forgery impacts services beyond FreeIPA itself.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionNVD
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.
AnalysisAI
Privilege escalation in FreeIPA allows an attacker with high LDAP write privileges to create a rogue service principal that impersonates a privileged existing one, bypassing the uniqueness constraint enforced by the 389-ds directory server. The flaw arises because 389-ds fails to recognize equivalent representations of the same Kerberos principal name (CWE-706), enabling the creation of a shadow principal that Kerberos treats as legitimate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an account holding sufficient LDAP write privileges within the FreeIPA 389-ds directory to create or modify entries in the Kerberos principal container (cn=services or cn=computers under the FreeIPA suffix). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) reflects the high-privilege prerequisite (PR:H), which significantly constrains the exploitable population to accounts that already hold elevated LDAP write permissions within the FreeIPA domain - typically delegated admins or compromised service accounts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A delegated FreeIPA administrator or a threat actor who has compromised an account with LDAP write privileges to the Kerberos container crafts a service principal name string that is an equivalent - but not byte-identical - representation of an existing privileged service principal (e.g., the HTTP service principal used by the FreeIPA web UI). The 389-ds uniqueness plug-in allows the duplicate to be written because string normalization is not applied during the uniqueness check. … |
| Remediation | Apply the Red Hat-issued errata for FreeIPA and 389-ds when published; consult https://access.redhat.com/security/cve/CVE-2026-13097 for errata availability by RHEL version, as no specific patched version number is confirmed in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct immediate inventory of all FreeIPA deployments in production and identify accounts with LDAP write privileges; audit and restrict LDAP administrative access to absolute minimum required personnel using principle of least privilege. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today