Threats Tagged 'cve-2026-76578'

A critical vulnerability (CVE-2026-76578) was found in FreeIPA where the self-managed OTP token Access Control Instruction (ACI) does not require authentication and does not restrict attribute additions. This flaw allows an unauthenticated LDAP client to create an arbitrary Kerberos principal and add it to the administrators group, gaining administrative privileges remotely. The issue is compounded by a related flaw in the underlying directory server's ACI evaluation. Red Hat has issued a security advisory with a patch to fix this vulnerability.

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

A critical vulnerability (CVE-2026-11861) was found in FreeIPA when a trust relationship is configured between FreeIPA and Active Directory. This flaw allows Active Directory users to obtain Ticket Granting Service (TGS) tickets with impersonating canonical names, potentially leading to unauthorized access. The issue is part of a broader set of security fixes addressing multiple vulnerabilities in FreeIPA, including unauthenticated denial of service, cross-site scripting, privilege escalation, and unauthorized LDAP writes. Red Hat has released updates for Red Hat Enterprise Linux 9 and related products to address these issues.