Cyber & AI intelligence
Wasteland.
Briefs indexed2459
Issues27
Published Mondays07:30 CT
CVE · Critical CVE-2026-76578 2026-09-07

CVE-2026-76578: Unauthenticated FreeIPA Flaw Grants Full Admin Takeover

"A missing-authentication flaw in FreeIPA's self-managed OTP token ACI may let a remote, unauthenticated attacker create a Kerberos principal and place it in the administrators group, earning genuine IdM admin rights…"

A missing-authentication flaw in FreeIPA's self-managed OTP token ACI may let a remote, unauthenticated attacker create a Kerberos principal and place it in the administrators group, earning genuine IdM admin rights; though the full chain depends on a second flaw in the underlying directory server.

What Is It

Red Hat disclosed a critical flaw (CVSS 3.1 base score 9.8, CWE-306 Missing Authentication for Critical Function) in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can abuse this, in combination with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group.

The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability.

Why It Matters

Where the chain succeeds, the outcome is not a partial bypass but real FreeIPA administrator-group membership. An attacker who succeeds can perform administrative operations against the directory itself, and on SID-enabled deployments, against other IdM services as well. Because FreeIPA/IdM is typically the identity backbone of a Linux estate, admin-group control would translate directly into broad control over the accounts and hosts that depend on it. No credentials are needed and no user has to be tricked into anything.

What's Vulnerable

Red Hat lists the ipa package as affected on:

Red Hat Enterprise Linux 6 (ipa) carries a default status of unknown.

Patch Status

The record was published 2026-09-07. The supplied data lists no fixed package versions, mitigations, or required actions. Administrators should track the Red Hat CVE page and Bugzilla entry below for fix availability.

Sources