The vulnerability CVE-2026-11861 affects FreeIPA when configured with a trust relationship to Active Directory. It allows an authenticated Active Directory user to impersonate a client name in the Ticket Granting Service (TGS) due to FreeIPA's failure to verify Privilege Attribute Certificate (PAC) certificates. This flaw enables bypassing authentication for FreeIPA services such as the portal, SMB server, and LDAP directory, potentially escalating privileges within the FreeIPA domain. Exploitation requires a cross-realm trust, a valid Active Directory account, and the ability to register a duplicate or conflicting Service Principal Name (SPN) in Active Directory. Microsoft mitigations in Windows Server 2012 R2 (with MSKB-3070083) and Windows 11 version 22H2 and later enforce SPN and UPN uniqueness, blocking this attack vector. Thus, the vulnerability primarily affects environments with outdated or unpatched Active Directory domain controllers. Red Hat has not provided an official patch or mitigation that meets their criteria for ease of use and applicability.

An authenticated Active Directory user in a FreeIPA-Active Directory trust environment can bypass authentication for FreeIPA services and escalate privileges within the FreeIPA domain. The impact includes unauthorized access to FreeIPA portal, SMB server, and LDAP directory services with high confidentiality and integrity impact but no availability impact. However, practical exploitation is limited to environments with unpatched or outdated Active Directory domain controllers that allow duplicate SPNs, making the risk theoretical in modern, maintained environments.

Red Hat currently does not offer a mitigation that meets their criteria for ease of use, deployment, applicability, or stability. The primary mitigation is to ensure that Active Directory domain controllers are patched and running supported functional levels that enforce SPN and UPN uniqueness constraints (e.g., Windows Server 2012 R2 with MSKB-3070083 or later, Windows 11 version 22H2 or later). Organizations should maintain updated Active Directory environments to block the attack path. No official patch for FreeIPA has been released yet; monitor the Red Hat advisory for updates.