Critical severity9.8NVD Advisory· Published Sep 7, 2026· Updated Oct 15, 2026
CVE-2026-76578
CVE-2026-76578
Description
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
35- osv-coords34 versionspkg:rpm/almalinux/python3-jwcryptopkg:rpm/almalinux/python3-yubicopkg:rpm/almalinux/slapi-nispkg:rpm/almalinux/softhsmpkg:rpm/almalinux/softhsm-develpkg:rpm/almalinux/ipa-client-epnpkg:rpm/almalinux/ipa-commonpkg:rpm/almalinux/bind-dyndb-ldappkg:rpm/almalinux/custodiapkg:rpm/almalinux/python3-qrcode-corepkg:rpm/almalinux/ipa-client-sambapkg:rpm/almalinux/ipa-client-commonpkg:rpm/almalinux/ipa-client-encrypted-dnspkg:rpm/almalinux/ipa-selinuxpkg:rpm/almalinux/ipa-serverpkg:rpm/almalinux/python3-ipatestspkg:rpm/almalinux/ipa-healthcheckpkg:rpm/almalinux/ipa-healthcheck-corepkg:rpm/almalinux/ipa-python-compatpkg:rpm/almalinux/opendnssecpkg:rpm/almalinux/python3-custodiapkg:rpm/almalinux/python3-kdcproxypkg:rpm/almalinux/python3-pyusbpkg:rpm/almalinux/python3-qrcodepkg:rpm/almalinux/ipa-server-dnspkg:rpm/almalinux/ipa-selinux-lunapkg:rpm/almalinux/ipa-server-encrypted-dnspkg:rpm/almalinux/python3-ipaclientpkg:rpm/almalinux/python3-ipalibpkg:rpm/almalinux/ipa-server-commonpkg:rpm/almalinux/ipa-clientpkg:rpm/almalinux/ipa-server-trust-adpkg:rpm/almalinux/ipa-selinux-nfastpkg:rpm/almalinux/python3-ipaserver
< 0.5.0-2.module_el8.10.0+3844+20e075e5+ 33 more
- (no CPE)range: < 0.5.0-2.module_el8.10.0+3844+20e075e5
- (no CPE)range: < 1.3.2-9.1.module_el8.7.0+3349+cfeff52e
- (no CPE)range: < 0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1
- (no CPE)range: < 2.6.0-5.module_el8.6.0+2881+2f24dc92
- (no CPE)range: < 2.6.0-5.module_el8.6.0+2881+2f24dc92
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 11.6-6.module_el8.10.0+3980+d78e8e90
- (no CPE)range: < 0.6.0-3.module_el8.6.0+2881+2f24dc92
- (no CPE)range: < 5.3-1.module_el8.10.0+3942+63b39a46
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 0.12-6.module_el8.10.0+4036+84b152d9
- (no CPE)range: < 0.12-6.module_el8.10.0+4036+84b152d9
- (no CPE)range: < 4.9.13-21.module_el8.10.0+4302+2d2000af.3
- (no CPE)range: < 2.1.7-2.module_el8.10.0+3980+d78e8e90
- (no CPE)range: < 0.6.0-3.module_el8.6.0+2881+2f24dc92
- (no CPE)range: < 0.4-5.module_el8.10.0+4069+1d9eaa78.2
- (no CPE)range: < 1.0.0-9.1.module_el8.7.0+3349+cfeff52e
- (no CPE)range: < 5.3-1.module_el8.10.0+3942+63b39a46
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
- (no CPE)range: < 4.13.4-1.el9_8
Patches
Vulnerability mechanics
References
10- access.redhat.com/errata/RHSA-2026:70564nvd
- access.redhat.com/errata/RHSA-2026:72279nvd
- access.redhat.com/errata/RHSA-2026:82935nvd
- access.redhat.com/errata/RHSA-2026:83083nvd
- access.redhat.com/errata/RHSA-2026:83084nvd
- access.redhat.com/errata/RHSA-2026:83085nvd
- access.redhat.com/errata/RHSA-2026:83460nvd
- access.redhat.com/errata/RHSA-2026:83461nvd
- access.redhat.com/security/cve/CVE-2026-76578nvd
- bugzilla.redhat.com/show_bug.cginvd
News mentions
2- ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and RootkitsThe Hacker News · Sep 14, 2026
- FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator CredentialsThe Hacker News · Sep 8, 2026