Full Report
A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group, Red Hat says. FreeIPA is the system that determines who may log in across a Linux domain and maintains all identities in a 389 Directory Server database accessed via LDAP. The attack needs a second flaw in that database software. The
Analysis Summary
# Vulnerability: FreeIPA/389-DS Authentication Bypass and Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-76578 (FreeIPA), CVE-2026-76560 (389 Directory Server)
- **CVSS Score:** 9.8 (Critical - Preliminary) for CVE-2026-76578; 7.5 (High) for CVE-2026-76560.
- **CWE:** Not explicitly stated (appears to be CWE-287: Improper Authentication and CWE-20: Improper Input Validation).
## Affected Systems
- **Products:** FreeIPA (shipped as Red Hat Identity Management / `ipa` package); 389 Directory Server (389-ds).
- **Versions:**
- FreeIPA versions prior to 4.13.4.
- Specifically reproduced on version 4.13.1.
- **Configurations:** Default installations of FreeIPA. For standalone 389 Directory Server, only deployments that have manually written access control rules (ACIs) that check for the "authenticated owner" of an entry.
## Vulnerability Description
This is a vulnerability chain involving two distinct flaws:
1. **FreeIPA Logic Flaw (CVE-2026-76578):** FreeIPA ships a default Access Control Instruction (ACI) that allows users to manage their own One-Time Password (OTP) tokens. Crucially, this rule does not verify if the client has actually logged in, nor does it restrict other directory attributes from being written alongside the token.
2. **389 Directory Server Logic Flaw (CVE-2026-76560):** The database's access control engine compares a client's name against a stored value. If a client is anonymous (not logged in), their name is empty. If the stored ownership field in the database is also empty, the engine incorrectly validates the match.
**The Chain:** An anonymous attacker creates a new token entry with blank ownership fields. The database permits this because "nobody" matches "nobody." The attacker then uses the FreeIPA ACI to write a new Kerberos identity and password into that entry, effectively creating a valid, reusable administrative identity.
## Exploitation
- **Status:** PoC available (Red Hat confirmed reproduction on stock container images). No known exploitation in the wild reported yet.
- **Complexity:** Low (Works on default/untouched installations).
- **Attack Vector:** Network (Unauthenticated remote access).
## Impact
- **Confidentiality:** High (Full access to directory data and Kerberos identities).
- **Integrity:** High (Ability to create administrator-level credentials and modify directory entries).
- **Availability:** High (Potential for domain-wide disruption via administrative access).
## Remediation
### Patches
- **FreeIPA:** Upgrade to **version 4.13.4** or later.
- **FreeIPA (Earlier fix):** Version 4.13.3 addressed a related collision flaw (CVE-2026-13097) but did not fully mitigate this chain.
### Workarounds
- No specific manual workarounds (such as ACI modifications) were detailed in the article; immediate patching of the `ipa` and `389-ds-base` packages is recommended.
## Detection
- **Indicators of Compromise:**
- Creation of unexpected Kerberos identities in the directory.
- New identities appearing in the administrators group without corresponding audit logs for authorized creation.
- Unusual LDAP write activity originating from unauthenticated/anonymous sessions targeting OTP token attributes.
- **Detection methods:** Monitor 389 Directory Server access logs for anonymous `ADD` or `MODIFY` operations targeting `ipaOTPToken` object classes.
## References
- FreeIPA Release Notes 4.13.4: hxxps://www[.]freeipa[.]org/release-notes/4-13-4[.]html
- Red Hat CVE-2026-76578 Advisory: hxxps://access[.]redhat[.]com/security/cve/CVE-2026-76578
- Red Hat Bugzilla 2519522: hxxps://bugzilla[.]redhat[.]com/show_bug[.]cgi?id=2519522