CVE-2026-11861: Incorrect Privilege Assignment in Red Hat Red Hat Enterprise Linux 10

This vulnerability in FreeIPA arises from improper verification of Privilege Attribute Certificate (PAC) certificates during trust relationships with Active Directory. Specifically, Active Directory users can impersonate client names in the Ticket Granting Service (TGS), bypassing authentication controls for FreeIPA services such as the portal, SMB server, and LDAP directory. This flaw enables authenticated Active Directory users to escalate their privileges within the FreeIPA domain. The issue is tracked as CVE-2026-11861 with a CVSS 3.1 score of 9.6 (critical). Red Hat has released patches for Red Hat Enterprise Linux 9.8 to remediate this vulnerability.

An authenticated Active Directory user can exploit this vulnerability to bypass authentication mechanisms in FreeIPA services and escalate privileges within the FreeIPA domain. This could lead to unauthorized access to sensitive services including the FreeIPA portal, SMB server, and LDAP directory, potentially compromising confidentiality and integrity of the affected systems. The CVSS score of 9.6 reflects a critical impact with high confidentiality and integrity impact and no user interaction required.

Red Hat has released an official security update that addresses CVE-2026-11861 as part of the ipa package update in Red Hat Enterprise Linux 9.8. Users should apply the update promptly following Red Hat's advisory instructions at https://access.redhat.com/articles/11258. The update fixes the improper verification of PAC certificates and prevents privilege escalation via trust relationships with Active Directory. No additional mitigations are indicated beyond applying the official patch.