A critical vulnerability has been identified in **FreeIPA**, the open-source identity management solution for Linux environments, which could enable an unauthenticated client to forge a Kerberos identity and gain administrative privileges. This severe flaw, rated 9.8 on the CVSS scale and tracked as **CVE-2026-76578**, requires a second vulnerability in the **389 Directory Server** (tracked as **CVE-2026-76560**) to be exploited. **FreeIPA** serves as the backbone for authentication across Linux domains, managing identities within a **389 Directory Server** database via LDAP. **Red Hat**, which ships **FreeIPA** as its **Identity Management product**, successfully reproduced the attack chain on a default installation, even without prior access. ## The Vulnerability Chain Explained The core of the **FreeIPA** flaw lies in an access control rule (ACI) designed to let users manage their own one-time-password tokens. Crucially, this rule does not demand client authentication and lacks restrictions on what other data can be written alongside the token. This becomes dangerous when combined with a defect in **389 Directory Server**. The directory server has a rule type intended to restrict operations to the authenticated owner of an entry. However, it compares the client's name against a stored value as plain text. An unauthenticated client has an empty name, which matches an empty stored value. Consequently, an anonymous client can create a token entry with blank ownership fields, bypass the ownership check, and then write a Kerberos identity and password into the directory. **Red Hat** rates the directory-server flaw at 7.5, noting that **Red Hat Directory Server** does not ship such a rule by default, making its impact dependent on custom configurations. However, **FreeIPA**'s default configuration includes precisely this vulnerable rule shape, making untouched installations susceptible. An earlier fix for **CVE-2026-13097** addressed an issue where an attacker could impersonate existing privileged accounts. While that specific collision is now blocked, the underlying unauthenticated write vulnerability persists, allowing attackers to create new administrator-level accounts with names of their choosing. For deployments leveraging Windows-style security identifiers, attackers can also obtain Kerberos tickets containing authorization data, potentially extending access to the server's HTTP and **Dogtag** services (FreeIPA's built-in certificate authority). ## A Separate, High-Severity Flaw Alongside the critical chain, **Red Hat** also disclosed **CVE-2026-79678**, an important **FreeIPA** flaw with a CVSS score of 8.1. This vulnerability is unrelated to the chain described above. The `idp-add` command in **FreeIPA** passes caller-supplied values (organization name and base URL) directly into a Python `eval()` call. This execution occurs *before* permission checks, meaning any authenticated account, regardless of its privileges, can reach it. While a pattern forbids brackets, preventing direct function calls and code execution, an attacker can still glean server process environment variables by observing error messages. More concerningly, they can exhaust server memory with short arithmetic expressions. This is particularly problematic for containerized **FreeIPA** installations, where the official server image often initializes with Directory Manager and administrator passwords stored as environment variables. If these passwords persist after initial setup, they could be exposed. **Red Hat** credits Gia Bui of Calif for reporting the **FreeIPA** chain and the directory-server flaw, and Calif, in collaboration with Anthropic, for the `idp-add` flaw. ## What Administrators Need to Do Now Fixes are being rolled out across various components. Administrators should prioritize patching based on their specific deployments: * **FreeIPA Project**: Update to **FreeIPA 4.13.4** which addresses both **FreeIPA**-specific flaws. * **389-ds-base on Red Hat Enterprise Linux and Red Hat Directory Server**: Apply the relevant advisories for your release. **RHSA-2026:64785**, for instance, covers **Red Hat Enterprise Linux 10** with `389-ds-base-3.2.0-10.el10_2` and is rated critical. * **ipa packages on Red Hat Enterprise Linux**: At the time of reporting, specific advisories for `ipa` packages on RHEL were not yet listed. * **389-ds-base on Fedora**: Updates are currently in testing. ### Temporary Mitigations Until fixed packages are available, **Red Hat** advises the following for the critical chain vulnerability: 1. **Restrict LDAP Service Access**: Limit access to LDAP services (typically ports 389 and 636) to trusted hosts using firewall rules or network segmentation. 2. **Disable Anonymous LDAP Binds**: Turning off anonymous LDAP binds can block this specific attack path. However, administrators must verify that no other services in their deployment rely on anonymous binds. For the `idp-add` flaw (**CVE-2026-79678**), there are no configuration-based mitigations; a fixed package is required. Users of containerized **FreeIPA** installations should also confirm that initial setup passwords are no longer present in the running process environment. Crucially, neither **Red Hat** nor the **FreeIPA** project has clarified whether **389 Directory Server** updates alone mitigate the **FreeIPA** attack if `ipa` packages remain outdated. Furthermore, guidance on detecting pre-existing attacker-created identities or whether applying fixes removes them is currently unavailable. No detection rules or indicators of compromise have been published in the advisories or bug reports.