CVE-2026-18147: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Red Hat Red Hat Enterprise Linux 10

CVE-2026-18147 is a DOM Cross-Site Scripting vulnerability in the FreeIPA/IdM Web UI password reset page of Red Hat Enterprise Linux 10. It allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript by enticing a victim to click a specially crafted URL and complete a password reset. This can enable actions within the victim's authenticated session and potentially full administrative control if the victim is an IdM administrator. Red Hat has released a security update for FreeIPA in Red Hat Enterprise Linux 9.8 that includes a fix for this vulnerability, as documented in RHSA-2026:70564. The advisory also addresses multiple other security issues in FreeIPA. The CVSS 3.1 base score is 8.1, indicating high severity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the victim's browser session on the FreeIPA/IdM Web UI password reset page. This can lead to actions performed with the victim's privileges, including potentially full administrative control if the victim is an IdM administrator. The vulnerability affects confidentiality and integrity but not availability.

Red Hat has released an official security update fixing this vulnerability as part of the FreeIPA package update in Red Hat Enterprise Linux 9.8. Users should apply the update described in Red Hat Advisory RHSA-2026:70564 promptly. The vendor advisory provides detailed instructions for applying the update. No additional mitigation is required beyond applying the official patch.