Critical FreeIPA Chain Allows Anonymous Creation of Admin Credentials
Red Hat has disclosed a critical FreeIPA vulnerability chain that can allow an anonymous client to create a Kerberos identity of its choosing and obtain membership in the administrators group. The primary issue, CVE-2026-76578, has a preliminary CVSS score of 9.8. It depends on CVE-2026-76560 in 389 Directory Server, rated 7.5.
FreeIPA manages identities and login access across Linux domains, storing directory data in 389 Directory Server and exposing it through LDAP. Red Hat reproduced the chain twice on a default installation, including on a machine with no prior access, and validated the outcome using administrator-only commands. The FreeIPA project has released version 4.13.4 to address both FreeIPA flaws.
How the anonymous write becomes an administrator identity
FreeIPA ships an access-control instruction, or ACI, that permits a user to manage that user’s own one-time-password token. The rule neither requires the client to have logged in nor limits the additional attributes that can be written with the token.
The second condition is in 389 Directory Server. Its ownership rule compares a client name with a stored value as plain text. An unauthenticated client has an empty name, so it can match an entry whose ownership value is also empty. An attacker can create a token entry with blank ownership fields, pass the ownership test, and write a Kerberos identity and password alongside the token.
Red Hat says the resulting identity can be assigned genuine administrator-group membership and used as reusable administrator credentials. The identity must be new: a prior FreeIPA fix for CVE-2026-13097, included in FreeIPA 4.13.3, blocked collisions with existing Kerberos names. That earlier flaw was distinct, involving alternative representations of the same Kerberos name.
Patch status and immediate mitigations
Red Hat’s directory-server advisory for Red Hat Enterprise Linux 10 identifies 389-ds-base-3.2.0-10.el10_2 in RHSA-2026:64785. Fourteen 389-ds advisories were published on 8 September, while the Fedora tracker was still marked ON_QA at the time reviewed. Red Hat’s records for the ipa packages did not yet list a fixed version or advisory on that date.
Until updated packages are available, Red Hat recommends restricting LDAP access, typically ports 389 and 636, to trusted hosts through firewall rules or network segmentation. Disabling anonymous LDAP binds blocks this path, but administrators should first confirm that no required service relies on them. The advisories do not state whether a 389-ds update alone blocks the FreeIPA chain on a host with outdated ipa packages, nor whether patching removes identities created before remediation.
A separate idp-add issue affects all authenticated accounts
Red Hat also disclosed CVE-2026-79678, an important FreeIPA issue scored 8.1 and unrelated to the credential-creation chain. The idp-add command passes caller-supplied organisation and base-URL values to Python eval() before its permission check. A pattern blocks brackets and prevents function calls, so Red Hat says code execution is not possible.
An authenticated account can nevertheless read process environment variables one at a time through returned errors and exhaust server memory with a short arithmetic expression. Container deployments warrant particular attention because the official FreeIPA server image may receive Directory Manager and administrator passwords in environment variables during first boot. Organisations should apply FreeIPA 4.13.4, track the relevant 389 Directory Server advisory, limit LDAP exposure, and verify that first-boot passwords are absent from running container environments.