Critical FreeIPA Flaw Chain Allows Anonymous Clients to Gain Administrator Privileges
A critical vulnerability chain in FreeIPA, combined with a flaw in its underlying 389 Directory Server, allows unauthenticated clients to create their own administrator credentials.
A critical vulnerability chain discovered in FreeIPA, a widely used identity management system for Linux domains, allows unauthenticated clients to create their own Kerberos identities and gain administrator privileges. This exploit, which leverages a flaw in FreeIPA itself and a second vulnerability in the underlying 389 Directory Server, could enable an attacker to effectively take over an entire Linux domain's identity management system.
Red Hat, which ships FreeIPA as its Identity Management product, has assigned the FreeIPA flaw the identifier CVE-2026-76578 and rated it critical with a preliminary CVSS score of 9.8. The vulnerability chain was successfully reproduced on a default installation, even on a machine with no prior network access, highlighting its severity. The FreeIPA project has already released a fix in version 4.13.4.
The attack exploits a specific access control rule (ACI) within FreeIPA that permits a user to manage their own one-time-password token without requiring prior authentication. This rule, however, does not restrict what other data can be written alongside the token. The danger escalates due to a second flaw in the 389 Directory Server.
This secondary vulnerability, tracked as CVE-2026-76560 and rated with a CVSS score of 7.5, resides in the directory server's access control mechanism. It incorrectly compares a client's name against a stored value as plain text. An unauthenticated client, having an empty name, can bypass this check by matching an empty stored value, thereby creating a token entry with blank ownership fields.
By exploiting this bypass, an anonymous client can then write a Kerberos identity and password of its choosing. While Red Hat notes that this specific flaw might only be critical in deployments that have custom-written such rules, FreeIPA's default configuration includes precisely this type of rule, making it vulnerable out-of-the-box.
An earlier vulnerability, CVE-2026-13097, had partially addressed a similar issue by blocking the impersonation of real admin accounts through matching Kerberos names. However, the underlying unauthenticated write capability remained. The current exploit bypasses this by allowing the attacker to create a new, unique identity instead of impersonating an existing one, achieving the same practical outcome of administrative control.
Beyond gaining administrator group membership, for deployments using Windows-style security identifiers, the attacker can also obtain a Kerberos ticket containing authorization data. This extends their access to critical services like the server's HTTP interface and Dogtag, FreeIPA's integrated certificate authority. Red Hat has released advisories and patches for affected Red Hat Enterprise Linux and Red Hat Directory Server versions.
In addition to this critical chain, Red Hat also disclosed a separate, important vulnerability (CVE-2026-79678) in FreeIPA's idp-add command. This flaw allows any authenticated user to read environment variables by observing server error responses and potentially exhaust server memory with arithmetic expressions. While not leading to code execution, it could expose sensitive information like administrator passwords in containerized environments.