CVE-2026-13097: Use of Incorrectly-Resolved Name or Reference in Red Hat Red Hat Enterprise Linux 10

This vulnerability involves a flaw in FreeIPA's handling of Kerberos principal name uniqueness in the 389-ds directory server. The uniqueness constraint does not correctly consider equivalent representations of the same principal name, enabling an attacker with sufficient LDAP write access to create a service principal that impersonates a privileged principal. This impersonation can allow unauthorized acquisition of Kerberos service tickets for sensitive services, potentially leading to full domain compromise. The issue is tracked as CVE-2026-13097 with a CVSS 3.1 score of 8.7 (high severity). Red Hat has issued a security advisory with patches addressing this vulnerability in FreeIPA packages for Red Hat Enterprise Linux 9, which is the closest available advisory. No explicit advisory for RHEL 10 was provided in the input, but the vulnerability description and vendor advisory indicate a fix is available.

Exploitation of this vulnerability can allow an attacker with LDAP write privileges to escalate their privileges by impersonating privileged Kerberos service principals. This can lead to unauthorized acquisition of Kerberos service tickets, enabling access to sensitive services and potentially resulting in full domain compromise. The CVSS score of 8.7 reflects high impact on confidentiality and integrity, with no impact on availability.

Red Hat has released security updates for FreeIPA packages that address this vulnerability. Users should apply the relevant updates as described in the Red Hat advisory (RHSA-2026:70564) and the referenced article https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires applying vendor-provided patches. Patch status is confirmed as available. No vendor advisory states that no action is required.