A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call… (CVE-2026-79678)

CVE-2026-79678 describes a vulnerability in FreeIPA's idp-add command where the --organization and --base-url inputs are insufficiently validated before being passed to a constrained eval() call. This occurs prior to the enforcement of LDAP access control checks, allowing any authenticated IPA principal, regardless of privilege level, to enumerate and read environment variables of the affected server process and to cause denial of service through memory exhaustion. The vulnerability has a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). Red Hat's advisory (RHSA-2026:70564) confirms the issue and provides patches for Red Hat Enterprise Linux 9.

The vulnerability allows any authenticated user in the IPA system to read sensitive environment variables from the server process, potentially exposing confidential information. Additionally, it enables denial of service attacks by exhausting memory resources. The impact is high confidentiality loss and high availability disruption, but no integrity impact is indicated.

Red Hat has released an official security update for FreeIPA in Red Hat Enterprise Linux 9 that addresses this vulnerability. Users should apply the update as soon as possible to remediate the issue. No additional mitigation steps are required beyond applying the vendor-provided patch.