CVE-2026-79678: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in Red Hat Red Hat Enterprise Linux 10

The vulnerability CVE-2026-79678 exists in FreeIPA's idp-add command where the --organization and --base-url inputs are insufficiently validated before reaching a constrained eval() call. This occurs prior to the enforcement of the corresponding LDAP access control check, allowing any authenticated IPA principal, regardless of privilege level, to enumerate and read environment variables of the affected server process. Additionally, this flaw can be exploited to cause denial of service via memory exhaustion. Red Hat has acknowledged this issue and included a fix in the ipa package updates for Red Hat Enterprise Linux 9.8, as documented in their security advisory RHSA-2026:70564.

An attacker with any authenticated IPA principal credentials can exploit this vulnerability to read environment variables of the server process, potentially exposing sensitive information. Furthermore, the attacker can cause a denial of service condition by exhausting server memory. The vulnerability does not allow privilege escalation or code execution beyond the described impacts. The CVSS v3.1 score of 8.1 reflects high confidentiality impact and high availability impact, with low attack complexity and low privileges required.

Red Hat has released an official fix for this vulnerability as part of the ipa package update included in Red Hat Enterprise Linux 9.8. Users should apply the security update RHSA-2026:70564 promptly to remediate this issue. The vendor advisory provides detailed instructions on applying the update. No additional mitigation steps are indicated beyond applying the official patch.