EUVD-2026-72356
GHSA-cgrx-2q4j-9f37
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IPA LDAP endpoint anonymously
-
DeliverySend crafted anonymous LDAP write to OTP token ACI
-
ExploitInject attributes creating Kerberos principal
-
ExecutionChain DS ACI flaw to add principal to admins group
-
PersistAuthenticate as admin principal
-
ImpactPerform full directory/IdM administrative operations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the FreeIPA/389-DS LDAP service (typically TCP 389/636) with anonymous/unauthenticated binds reachable, and the self-managed OTP token ACI present in its vulnerable form. Full admin-group takeover additionally requires the separately-tracked underlying directory-server ACI evaluation flaw to be present - this chaining is the key limiting factor, meaning a deployment patched against the companion DS flaw is not fully exploitable to admin membership even if this ACI is unfixed. SID-enabled deployments broaden impact to other IdM services. No authentication, user interaction, or special client is otherwise needed (PR:N/UI:N). |
| Impact | The signals are largely consistent in the direction of high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H reflects fully remote, unauthenticated, no-interaction exploitation yielding complete tenant compromise (creation of an admin principal). The most important nuance is that exploitation is a CHAIN - it depends on the separately-tracked directory-server ACI evaluation flaw to succeed end-to-end; standalone, the OTP ACI weakness enables anonymous writes but the full admin-group takeover requires the companion defect, so patch/coverage assessment should track both. Offsetting signals: there is no EPSS score, no POC, and no CISA KEV entry provided, so there is currently no evidence of active or automatable exploitation in the wild - the 9.8 is a plausibility-of-impact rating rather than a demonstrated-exploitation rating. Given that FreeIPA/IdM is the central identity authority for the domains it serves, a successful attack is a domain-wide catastrophe, so any operator running an internet-reachable or broadly-reachable IPA/LDAP endpoint should treat this as urgent regardless of the missing EPSS/KEV data. Verify the fix covers both this ACI and the linked DS flaw before considering the issue closed. |
| Exploit ScenarioDerived | An attacker with only network reachability to the IPA LDAP endpoint sends anonymous LDAP writes against the self-managed OTP token ACI, injecting attributes that define a new Kerberos principal, and - leveraging the related directory-server ACI evaluation flaw - gets that principal added to the administrators group. The attacker then authenticates as that principal and performs full administrative operations against the directory and, on SID-enabled deployments, other IdM services. No POC is currently identified, and CVSS AC:L/PR:N/UI:N indicates the attack is straightforward once both flaws are present. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine administrators-group membership. The self-managed OTP token ACI does not require authentication and fails to restrict which attributes may be added alongside a token entry; chained with a separately-tracked directory-server ACI evaluation flaw, an unauthenticated LDAP client can create an attacker-controlled Kerberos principal and place it in the administrators group. Assigned CVSS 9.8 (CWE-306, Missing Authentication); no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the Red Hat-provided ipa/freeipa update once available for your RHEL stream - consult https://access.redhat.com/security/cve/CVE-2026-76578 and bug 2519522 (https://bugzilla.redhat.com/show_bug.cgi?id=2519522) for the exact fixed package versions, and ensure the companion directory-server ACI fix is applied as well since exploitation is a chain across both. No fixed version was included in the input, so do not assume a build number. As a compensating control until patched, restrict anonymous/unauthenticated LDAP access to the IPA directory (tighten the self-managed OTP token ACI or disable anonymous binds where feasible) and limit network reachability of ports 389/636 to trusted management networks only - note that hardening anonymous LDAP or self-service OTP enrollment can break legitimate token self-management and any tooling that relies on anonymous reads, so test in staging. Monitor directory audit logs for unexpected creation of Kerberos principals and additions to the administrators group.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FreeIPA is the upstream project behind Red Hat Identity Management (IdM), providing integrated LDAP (389 Directory Server), Kerberos KDC, DNS, and certificate services for Linux/Unix domains. The root cause is CWE-306 (Missing Authentication for a Critical Function): FreeIPA ships an Access Control Instruction (ACI) intended to let users self-manage their own OTP tokens, but this ACI permits anonymous (unauthenticated) LDAP writes and does not constrain which attributes accompany the token object. Because attribute injection is unrestricted, an attacker can smuggle in the attributes needed to define a Kerberos principal. The impact is amplified by a related, separately-tracked defect in the underlying 389 Directory Server ACI evaluation logic, which together permit the crafted entry to be added and then linked into the privileged administrators group. On SID-enabled (Security Identifier) deployments, the compromised principal also gains reach into other IdM-integrated services.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated LDAP write with no interaction yields attacker-created admin principal, giving full confidentiality, integrity, and availability control over the identity store.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
Executive ViewAI
FreeIPA (Red Hat Identity Management) contains a critical unauthenticated remote privilege escalation vulnerability that enables attackers to gain administrative access without any credentials. This directly compromises the identity infrastructure that all dependent systems rely on for authentication and authorization. Organizations using FreeIPA face complete loss of access control if exploited, as attackers would possess legitimate administrative credentials within the authentication system itself.
In the absence of a vendor patch, restrict network access to FreeIPA LDAP ports (389, 636) to only authorized administrative and dependent systems using firewall rules; implement strict egress filtering to prevent compromised systems from reaching FreeIPA; enable and continuously monitor LDAP audit logs for suspicious principal creation or group membership additions; consider deploying FreeIPA in a highly restricted network segment with limited access; implement mutual TLS authentication for all LDAP connections to add an additional authentication layer; rotate all Kerberos keys and administrative credentials immediately if any unauthorized access is suspected; and conduct weekly manual reviews of LDAP group membership to identify unauthorized entries.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB