Threats Tagged 'cve-2026-19550'

CVE-2026-19550 is a high-severity authorization flaw in FreeIPA on Red Hat Enterprise Linux 9. It allows an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using attacker-supplied server and credentials. This results in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory. The vulnerability only affects IdM/FreeIPA servers with an established cross-forest trust with Active Directory. Exploitation requires no administrative privileges but does require an authenticated user account. The issue is fixed upstream, and administrators should apply the fix when available. Until then, restricting the "System: Read Trust Information" permission is a valid interim workaround, though it may impact SSSD subdomain support.

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.