FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials
A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group, Red Hat says. FreeIPA is the system that determines who may log in across a Linux domain and maintains all identities in a 389 Directory Server database accessed via LDAP. The attack needs a second flaw in that database software. The FreeIPA project has already fixed its side in version 4.13.4 . Red Hat says it reproduced the chain twice on a default installation, most recently on a machine with no access at all. Red Hat tracks the FreeIPA flaw as CVE-2026-76578 and rates it critical, with a CVSS score of 9.8. The same page says that score is preliminary and subject to review. Red Hat ships FreeIPA as its Identity Management product , where the package is called ipa . FreeIPA ships an access control rule, called an ACI, that lets a user manage their own one-time-password token. The rule does no...
Sep 08, 2026