EUVD-2026-72356
GHSA-cgrx-2q4j-9f37
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated LDAP write with no interaction yields attacker-created admin principal, giving full confidentiality, integrity, and availability control over the identity store.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
AnalysisAI
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine administrators-group membership. The self-managed OTP token ACI does not require authentication and fails to restrict which attributes may be added alongside a token entry; chained with a separately-tracked directory-server ACI evaluation flaw, an unauthenticated LDAP client can create an attacker-controlled Kerberos principal and place it in the administrators group. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network access to the FreeIPA/389-DS LDAP service (typically TCP 389/636) with anonymous/unauthenticated binds reachable, and the self-managed OTP token ACI present in its vulnerable form. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent in the direction of high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H reflects fully remote, unauthenticated, no-interaction exploitation yielding complete tenant compromise (creation of an admin principal). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Red Hat-provided ipa/freeipa update once available for your RHEL stream - consult https://access.redhat.com/security/cve/CVE-2026-76578 and bug 2519522 (https://bugzilla.redhat.com/show_bug.cgi?id=2519522) for the exact fixed package versions, and ensure the companion directory-server ACI fix is applied as well since exploitation is a chain across both. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all FreeIPA deployments and their role in your authentication architecture, and identify all systems and applications that depend on FreeIPA for authentication. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today