A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added… (CVE-2026-76578)

The vulnerability in FreeIPA involves the self-managed OTP token ACI lacking authentication requirements and attribute restrictions. An unauthenticated LDAP client can exploit this, together with a separate flaw in the directory server's ACI evaluation, to create an attacker-controlled Kerberos principal and add it to the administrators group. This grants the attacker genuine administrator-group membership, enabling administrative operations on the directory and other IdM services in SID-enabled deployments. The CVSS v3.1 base score is 9.8, indicating critical severity. Red Hat has released an update for ipa in Red Hat Enterprise Linux 9 to address this issue.

An unauthenticated remote attacker can obtain genuine FreeIPA administrator-group membership, allowing them to perform administrative operations against the directory and other Identity Management services. This leads to full compromise of FreeIPA administrative functions and potentially broader IdM service impact on SID-enabled deployments.

Red Hat has released an official security update for ipa in Red Hat Enterprise Linux 9 that fixes this vulnerability. Users should apply the update as soon as possible to remediate the issue. No additional mitigation steps are required beyond applying the vendor-provided patch.