A critical privilege escalation flaw in FreeIPA (CVSS 9.1) lets a user with sufficient LDAP write privileges register a service principal that impersonates an existing privileged one, opening a path to full domain compromise.
What Is It
FreeIPA relies on the 389-ds directory server to enforce a uniqueness constraint on Kerberos principal name attributes. That constraint does not properly account for equivalent representations of the same principal name; meaning two entries that resolve to the same principal can coexist because they are not byte-identical.
An attacker with sufficient LDAP write privileges can abuse this gap to create a service principal that impersonates an existing privileged one. From there, they can obtain Kerberos service tickets for sensitive services they were never authorized to reach. Red Hat classifies the weakness as CWE-706 (Use of Incorrectly-Resolved Name or Reference).
Why It Matters
The CVSS 3.1 base score is 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The scope is Changed and confidentiality, integrity, and availability impacts are all High; consistent with an escalation that reaches beyond the vulnerable component into the wider domain. The vendor states the outcome plainly: potential full domain compromise.
Attack complexity is Low and no user interaction is required, but privileges required are High; the attacker must already hold meaningful LDAP write access. This is an escalation and lateral-movement primitive for an attacker who has established a foothold, not an unauthenticated entry point.
CVE-2026-13097 is not currently listed in CISA's Known Exploited Vulnerabilities catalog, so there is no confirmed active exploitation or federal remediation deadline attached to it at this time.
What's Vulnerable
Per Red Hat's security advisory for this CVE, the affected package is ipa across Red Hat Enterprise Linux:
- Red Hat Enterprise Linux 7; affected
- Red Hat Enterprise Linux 8; affected
- Red Hat Enterprise Linux 9; affected
- Red Hat Enterprise Linux 10; affected
- Red Hat Enterprise Linux 6; status not stated by Red Hat
Patch Status
The CVE was published 2026-08-20 and its NVD status is Awaiting Analysis. Red Hat's CVE page does not yet list fixed package versions or specific remediation steps. Administrators running FreeIPA on RHEL should track the Red Hat CVE page and Bugzilla entry below for errata as they are released.
Sources
- NVD, CVE-2026-13097 (record ID
CVE-2026-13097, source[email protected]) - Red Hat Security; https://access.redhat.com/security/cve/CVE-2026-13097
- Red Hat Bugzilla #2515974; https://bugzilla.redhat.com/show_bug.cgi?id=2515974