CVE-2026-76578
Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
- Affected
- Red Hat · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.8 Telecommunications Update Service · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions · Red Hat Enterprise Linux 9
- CVSS v3.1 REDHAT
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 1.21% chance of exploitation in the next 30 days, 68th percentile
- Published
- 2026-09-07
- Updated
- 2026-10-15
Proof-of-concept exploits (1)
- BrainBob/CVE-2026-765780★ · 2026-09-09