A critical authentication bypass in FreeIPA (CVSS 9.6) allows any authenticated Active Directory user to impersonate arbitrary principals across trusted FreeIPA services because those services fail to verify Kerberos PAC certificates.
What Is It
Red Hat disclosed a flaw in FreeIPA affecting deployments that have a trust relationship configured with Active Directory. FreeIPA services do not verify Privilege Attribute Certificate (PAC) data on incoming tickets. That omission allows an Active Directory user to impersonate a client name in the Ticket Granting Service (TGS) exchange and bypass authentication for FreeIPA services; including the web portal, the SMB server, and the LDAP directory.
The result is privilege escalation inside the FreeIPA domain: an ordinary authenticated AD user can act as a higher-privileged FreeIPA principal. The issue is classified as CWE-266 (Incorrect Privilege Assignment).
Why It Matters
The CVSS 3.1 base score is 9.6 CRITICAL, vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The combination that drives that score matters more than the number: network attack vector, low attack complexity, only low privileges required, no user interaction, and a changed scope: the attack crosses a trust boundary from the AD side into the FreeIPA domain. Confidentiality and integrity impact are both HIGH.
Because LDAP and SMB are in scope alongside the portal, a successful bypass reaches identity data and file services, not just a web frontend. Any organization running FreeIPA as its Linux identity backend with an AD trust should treat this as an identity-infrastructure compromise scenario.
What's Vulnerable
Red Hat lists the ipa package as affected on:
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 6; status listed as unknown
The vulnerable condition requires a configured FreeIPA-to-Active-Directory trust.
Patch Status
The CVE was published 2026-08-20 and its NVD record status is Awaiting Analysis. Neither the NVD entry nor the Red Hat CVE page states fixed versions, mitigations, or required-action deadlines at this time. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, so there is no confirmation of active exploitation. Consult the Red Hat CVE page for erratum availability per RHEL release.
Sources
- Red Hat Security; CVE-2026-11861: https://access.redhat.com/security/cve/CVE-2026-11861
- Red Hat Bugzilla #2487472: https://bugzilla.redhat.com/show_bug.cgi?id=2487472
- NVD, CVE-2026-11861 (published 2026-08-20, Awaiting Analysis): https://nvd.nist.gov/vuln/detail/CVE-2026-11861
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog