EUVD-2026-56977
GHSA-6xg7-8fr6-8p33
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Network access with low-privilege auth required; AC:H reflects mandatory attacker-controlled AD server infrastructure; S:C because the LDAP identity store is external to the vulnerable command.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
AnalysisAI
Incorrect authorization in FreeIPA's trust-fetch-domains command allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, writing attacker-controlled trusted-domain and ID-range data into the FreeIPA LDAP directory. The flaw (CWE-863) stems from the command being gated by a read-only trust object permission rather than the required trust-administration permission, effectively bypassing the authorization boundary between read and write operations on cross-realm identity data. No public exploit has been identified and CISA has not listed this in KEV, but the scope-changed CVSS score of 8.2 and high integrity impact reflect serious potential for identity infrastructure tampering in environments running AD trusts.
Technical ContextAI
FreeIPA is an integrated identity management platform for Linux/UNIX environments, bundling Kerberos, LDAP (389-ds), DNS, and certificate management. It is the upstream project for Red Hat Identity Management (IdM) and is commonly deployed in RHEL environments to manage user authentication and, optionally, cross-realm trusts with Microsoft Active Directory. The trust-fetch-domains command is an administrative RPC operation that synchronizes AD domain metadata and ID range mappings into FreeIPA's LDAP backend - it is by nature a privileged write operation. The root cause is CWE-863 (Incorrect Authorization): the command's permission check enforces only a read-level ACL on the trust object rather than requiring the trust-administration privilege, so the authorization gate succeeds for any authenticated IPA user who holds the weaker read permission. The AC:H metric in the provided CVSS vector reflects a genuine complexity barrier: the attacker must supply and operate an AD-compatible server that returns crafted domain/ID-range data, requiring non-trivial attacker-controlled infrastructure beyond a simple network request.
RemediationAI
Apply the vendor-released patch from Red Hat for the ipa or ipa-server package on the affected RHEL version; the specific patched package version is not confirmed in the available data and must be verified against the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-19550 or the Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2514019. As a compensating control prior to patching, administrators should audit which IPA user accounts hold any trust-related read permissions and restrict trust-read ACLs to the minimum set of accounts that legitimately require AD trust visibility - this raises the bar for exploitation but does not eliminate the flaw. Network-layer controls restricting which hosts can connect to the IPA API (typically TCP 443 and TCP 8443) reduce the attack surface by limiting who can invoke trust-fetch-domains remotely, though this does not remediate the authorization bypass. Completely disabling the trust-fetch-domains RPC is a high-disruption workaround that would break AD trust synchronization and should only be considered in environments where the AD trust is dormant or can be temporarily suspended.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today