CVE-2026-76578
Received Received - Intake

Authentication Bypass in FreeIPA Leading to Privilege Escalation

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: redhat-SADP

Description
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-76578
EUVD
EUVD-2026-72356

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat freeipa *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical vulnerability in FreeIPA, an identity management system. It allows an unauthenticated attacker to exploit a missing authentication requirement in the self-managed OTP token Access Control Instruction (ACI) combined with a separate directory server ACI evaluation issue. This enables the attacker to create an arbitrary Kerberos principal and add it to the administrators group, granting full administrative privileges without any credentials or prior access.

Detection Guidance

Check for unauthorized LDAP modifications by reviewing logs for anonymous binds or unexpected OTP token entries. Use commands like 'ldapsearch -x -H ldap://<server> -b "cn=accounts,dc=example,dc=com" "(objectClass=ipaToken)"' to inspect token entries. Verify admin group membership changes with 'ipa group-show admins' and check Kerberos tickets with 'klist -f' for unknown principals.

Impact Analysis

An attacker could gain full administrative access to your FreeIPA system, allowing them to perform administrative operations, read or modify sensitive data, and disrupt the directory. Exploitation requires only network access to the LDAP service on default FreeIPA installations. On SID-enabled deployments, the attacker could also access HTTP/Dogtag services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. Administrative access allows attackers to read or modify data, potentially resulting in data breaches and non-compliance with data protection standards.

Mitigation Strategies

Restrict network access to LDAP ports (389/636) to trusted hosts only. Disable anonymous LDAP binds if possible, but test for compatibility first. Monitor for unauthorized admin group additions and Kerberos principal creations. Apply vendor patches once available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76578. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart