Search: CVE-2026-76578

CVE-2026-76578 is a critical vulnerability in FreeIPA on Red Hat Enterprise Linux 10 that allows unauthenticated LDAP clients to create arbitrary Kerberos principals and add them to the administrators group. This flaw arises from missing authentication in the self-managed OTP token Access Control Information (ACI) and insufficient attribute restrictions. Exploitation enables remote attackers with no credentials or user interaction to gain administrative privileges on FreeIPA/IdM servers, potentially compromising directory and identity management services.