FreeIPA CVE-2026-79678

Exploitation requires a valid Kerberos authentication ticket or equivalent credentials for any IPA realm principal - a standard low-privilege domain user account is sufficient; no admin role, special group membership, or non-default configuration is needed. The idp-add command handler is accessible to all authenticated principals over the standard IPA HTTPS API (TCP 443), and the eval() fires before the ACL check that would otherwise require admin privilege. Limiting factors: the eval() is described by the reporter as 'constrained', meaning full arbitrary OS command execution is not confirmed - demonstrated impact is bounded to server environment variable enumeration and memory exhaustion DoS. Exploitation is also bounded to principals who can reach the IPA API endpoint over the network.

The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) accurately characterizes the threat posture: the IPA API is network-reachable, exploitation requires no special privilege beyond a valid Kerberos ticket or domain account, and there is no complexity barrier or user interaction needed. The C:H score is justified because server process environment variables in IPA deployments frequently contain sensitive material - Kerberos keytabs, LDAP bind credentials, database passwords, or API keys - making env-var exfiltration a meaningful secrets-disclosure risk. The A:H reflects confirmed memory exhaustion capability affecting all IPA-dependent services (LDAP, Kerberos, certificate management). No EPSS score is available in the source data, and no KEV listing or public exploit code has been identified, which moderates urgency somewhat. Even a mid-sized municipal IT team in ustka relying on FreeIPA for Active Directory-equivalent SSO would face a significant risk, since any domain user account is sufficient for exploitation, and large RHEL deployments often distribute domain membership broadly. The PR:L prerequisite meaningfully narrows the attack surface versus PR:N but should not be treated as a strong mitigating factor in environments with broad domain account provisioning.

An attacker holding any valid Kerberos credential for the IPA domain - for example, a standard employee account - authenticates to the IPA API and issues a crafted idp-add request with a malicious string in the --organization parameter. Before the server's LDAP ACL check rejects the operation as unauthorized, the eval() processes the payload and returns the server process's environment variables in the error response or side channel, potentially exposing credentials. The attacker may repeat the call with a memory-intensive payload to exhaust the IPA server's heap and force service unavailability for the entire organization. No public proof-of-concept has been identified, but the vulnerability class (eval injection with known parameter names) is straightforward to exploit for a researcher familiar with FreeIPA's API.