CVE-2026-13097: Use of Incorrectly-Resolved Name or Reference in Red Hat Red Hat Enterprise Linux 9

This vulnerability involves a flaw in FreeIPA's handling of Kerberos principal name attributes within the 389-ds directory server. The uniqueness constraint does not properly consider equivalent representations of the same principal name, enabling an attacker with LDAP write access to create a service principal that impersonates an existing privileged one. Exploiting this flaw can allow unauthorized acquisition of Kerberos service tickets, potentially resulting in full domain compromise. The vulnerability requires the attacker to already have LDAP write privileges to a computer account or an account with rights to add entries in the LDAP directory. It cannot be used to launch denial of service attacks as LDAP privileges do not generally coincide with system privileges.

An attacker with sufficient LDAP write privileges can escalate their privileges by creating a service principal that impersonates an existing privileged principal. This enables unauthorized acquisition of Kerberos service tickets for sensitive services, which may lead to full domain compromise. The vulnerability affects confidentiality and integrity but does not impact availability.

Red Hat has published an advisory for CVE-2026-13097. Users should consult the official Red Hat advisory for specific patch or update instructions. Since the vulnerability requires existing LDAP write privileges, limiting such privileges reduces risk. Patch status is not explicitly stated in the provided advisory content; therefore, check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-13097 for current remediation guidance.