CVE-2026-76578: Missing Authentication for Critical Function in Red Hat Red Hat Enterprise Linux 10

The vulnerability in FreeIPA involves a missing authentication requirement for the self-managed OTP token ACI, combined with a related flaw in the directory server's ACI evaluation. An unauthenticated LDAP client can exploit this to create an attacker-controlled Kerberos principal and add it to the administrators group. This results in unauthorized administrative access to the directory and IdM services. The issue is tracked as CVE-2026-76578 with a CVSS 3.1 base score of 9.8 (critical). Red Hat has released a security update for Red Hat Enterprise Linux 9 (including version 9.8) addressing this and other FreeIPA vulnerabilities.

An unauthenticated remote attacker can gain genuine FreeIPA administrator-group membership, allowing them to perform administrative operations on the directory and, in SID-enabled deployments, other Identity Management services. This compromises the integrity and confidentiality of the affected systems and potentially the entire identity management infrastructure.

Red Hat has released an official security update fixing this vulnerability as part of the ipa package update in Red Hat Enterprise Linux 9. Users should apply the update as described in Red Hat Advisory RHSA-2026:70564. The vendor advisory provides detailed instructions for remediation. No additional mitigation steps are indicated beyond applying the official patch.