Affected Systems

FreeIPA versions prior to 4.13.4 and 389 Directory Server (389-ds-base) on Red Hat Enterprise Linux and Red Hat Directory Server. Red Hat Identity Management (ipa package) is affected. Default installations are vulnerable. CVE-2026-76578 (FreeIPA, CVSS 9.8 preliminary), CVE-2026-76560 (389 Directory Server, CVSS 7.5), and separate CVE-2026-79678 (FreeIPA idp-add command injection, CVSS 8.1).

Exploitation Status

No evidence of exploitation in the wild. Red Hat successfully reproduced the attack chain twice on default installations, including on a machine with no prior access. The vulnerability is fully understood and reproducible but not yet observed in real attacks.

Business Impact

Unauthenticated attackers can create arbitrary Kerberos identities with administrator group membership on vulnerable FreeIPA deployments, gaining full domain control. This bypasses all authentication and authorization controls. Attackers obtain reusable administrator credentials and can access HTTP services, Dogtag certificate authority, and potentially all domain-joined Linux systems. The separate idp-add flaw (CVE-2026-79678) allows any authenticated user to read process environment variables, potentially exposing Directory Manager and admin passwords in container deployments, and to exhaust server memory.

Urgency

🔴 Immediate

Recommended Actions

  • Upgrade FreeIPA to version 4.13.4 immediately on all installations to fix CVE-2026-76578 and CVE-2026-79678
  • Apply 389-ds-base security updates published September 8, 2026 for your Red Hat Enterprise Linux or Red Hat Directory Server version to fix CVE-2026-76560
  • Audit FreeIPA Kerberos identities and administrator group membership for unauthorized entries created since deployment, focusing on accounts with blank ownership fields
  • For containerized FreeIPA deployments, verify that Directory Manager and administrator passwords passed as environment variables at first boot are cleared after setup completes
  • Monitor LDAP access logs for anonymous client connections creating token entries or writing Kerberos principals without prior authentication