What’s Vulnerable › Vulnerabilities

CVE-2026-19550: Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-30
• Weakness: CWE-863

Description

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

Affected products

• FreeIPA ipa: before 4.13.3 — fixed in 4.13.3
• Red Hat Enterprise Linux: 7.0, 8.0, 9.0, 10.0 (and their updates)
• Red Hat Enterprise Linux 10: all versions — fixed in 0:4.13.4-1.el10_2
• Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:4.12.2-15.el10_0.7
• Red Hat Enterprise Linux 7 Extended Lifecycle Support: all versions — fixed in 0:4.6.8-5.el7_9.25
• Red Hat Enterprise Linux 8: all versions — fixed in 8100020261007071200.143e9e98
• Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 8060020261008134123.c1533a64
• Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: all versions — fixed in 8060020261008134123.c1533a64
• Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 8080020261007080925.e581a9e4
• Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 8080020261007080925.e581a9e4
• Red Hat Enterprise Linux 9: all versions — fixed in 0:4.13.4-1.el9_8
• Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:4.10.1-12.el9_2.7
• Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: all versions — fixed in 0:4.11.0-15.el9_4.9
• Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:4.12.2-14.el9_6.8

How to fix

Upgrade to a fixed version: FreeIPA ipa 4.13.3; Red Hat Enterprise Linux 10 0:4.13.4-1.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:4.12.2-15.el10_0.7; Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:4.6.8-5.el7_9.25; Red Hat Enterprise Linux 8 8100020261007071200.143e9e98; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020261008134123.c1533a64; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020261008134123.c1533a64; Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020261007080925.e581a9e4; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020261007080925.e581a9e4; Red Hat Enterprise Linux 9 0:4.13.4-1.el9_8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:4.10.1-12.el9_2.7; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:4.11.0-15.el9_4.9. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:70564
• https://access.redhat.com/errata/RHSA-2026:72279
• https://access.redhat.com/errata/RHSA-2026:82935
• https://access.redhat.com/errata/RHSA-2026:83083
• https://access.redhat.com/errata/RHSA-2026:83084
• https://access.redhat.com/errata/RHSA-2026:83085
• https://access.redhat.com/errata/RHSA-2026:83460
• https://access.redhat.com/errata/RHSA-2026:83461
• https://access.redhat.com/errata/RHSA-2026:89836
• https://access.redhat.com/errata/RHSA-2026:93071
• https://access.redhat.com/security/cve/CVE-2026-19550
• https://bugzilla.redhat.com/show_bug.cgi?id=2514019

Get alerted when CVE-2026-19550 or the next vulnerability affects your stack