CVE-2026-76578: Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-07 · updated 2026-10-30
Weakness: CWE-306

Description

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

Affected products

Red Hat Enterprise Linux 10: all versions — fixed in 0:4.13.4-1.el10_2
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:4.12.2-15.el10_0.7
Red Hat Enterprise Linux 7 Extended Lifecycle Support: all versions — fixed in 0:4.6.8-5.el7_9.25
Red Hat Enterprise Linux 8: all versions — fixed in 8100020261007071200.143e9e98
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 8060020261008134123.c1533a64
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: all versions — fixed in 8060020261008134123.c1533a64
Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 8080020261007080925.e581a9e4
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 8080020261007080925.e581a9e4
Red Hat Enterprise Linux 9: all versions — fixed in 0:4.13.4-1.el9_8
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:4.10.1-12.el9_2.7
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: all versions — fixed in 0:4.11.0-15.el9_4.9
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:4.12.2-14.el9_6.8

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:4.13.4-1.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:4.12.2-15.el10_0.7; Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:4.6.8-5.el7_9.25; Red Hat Enterprise Linux 8 8100020261007071200.143e9e98; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020261008134123.c1533a64; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020261008134123.c1533a64; Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020261007080925.e581a9e4; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020261007080925.e581a9e4; Red Hat Enterprise Linux 9 0:4.13.4-1.el9_8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:4.10.1-12.el9_2.7; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:4.11.0-15.el9_4.9; Red Hat Enterprise Linux 9.6 Extended Update Support 0:4.12.2-14.el9_6.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-76578 or the next vulnerability affects your stack