EUVD-2026-72357
GHSA-2rwh-2wx9-4qwh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
IPA API is network-reachable (AV:N), any authenticated domain user suffices (PR:L, AC:L), no integrity impact confirmed, C:H for env-var secrets, A:H for memory exhaustion DoS.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.
AnalysisAI
Eval injection in FreeIPA's idp-add command allows any authenticated IPA domain principal, regardless of privilege, to enumerate the server process's environment variables and cause memory exhaustion denial of service. The flaw arises because user-supplied --organization and --base-url inputs reach a constrained eval() call before the LDAP access control check that should gate idp-add to IPA administrators is enforced - creating an authorization-order bypass. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Kerberos authentication ticket or equivalent credentials for any IPA realm principal - a standard low-privilege domain user account is sufficient; no admin role, special group membership, or non-default configuration is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) accurately characterizes the threat posture: the IPA API is network-reachable, exploitation requires no special privilege beyond a valid Kerberos ticket or domain account, and there is no complexity barrier or user interaction needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Red Hat-issued errata update for FreeIPA via standard RHEL subscription channels (yum/dnf update ipa-server) once released; no specific fixed package version is confirmed in the current advisory data, so monitor https://access.redhat.com/security/cve/CVE-2026-79678 for errata RHSA details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all FreeIPA deployments and confirm which installations have idp-add accessible to non-administrator accounts; coordinate with the identity team to document current LDAP access control policies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
FreeIPA might display user data improperly via vectors involving non-printable characters. Rated high severity (CVSS 7.5
ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem,
The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) i
FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions v
A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before
The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate fro
FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows
FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services. Rated high severity (CVSS 7.5), thi
The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authentic
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA.
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before
Same weakness CWE-95 – Eval Injection
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today