Authentication Bypass in FreeIPA via PAC Impersonation

Executive Summary

CVE-2026-11861 is a flaw in FreeIPA where Active Directory users can bypass authentication for FreeIPA services like the portal, SMB server, and LDAP directory. This happens when FreeIPA does not verify PAC certificates in the Ticket Granting Service (TGS), allowing impersonation and privilege escalation within the FreeIPA domain.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking FreeIPA services for improper PAC certificate verification in TGS tickets. Monitor logs for failed authentication attempts or unusual service access patterns. Use commands like 'ipa trust-show' to verify trust relationships and 'klist -v' to inspect Kerberos tickets for suspicious client name impersonation.

Useful 0 Not Useful 0

Impact Analysis

An authenticated Active Directory user could exploit this to gain unauthorized access to FreeIPA services, escalate privileges, and potentially compromise the FreeIPA domain. This could lead to data breaches, unauthorized modifications, or service disruptions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using FreeIPA with Active Directory trusts may face compliance risks due to potential exposure of sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable cross-realm trusts between FreeIPA and Active Directory if not required. Apply patches from Red Hat once available. Restrict Active Directory user access to FreeIPA services and enforce SPN/UPN uniqueness. Monitor for unauthorized privilege escalation attempts in FreeIPA logs.

Useful 0 Not Useful 0