CVE-2026-79678
Received Received - Intake

Privilege Escalation via Eval Injection in FreeIPA

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: redhat-SADP

Description
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-79678
EUVD
EUVD-2026-72357

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat freeipa *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an eval injection flaw in FreeIPA's idp-add command. It occurs because unvalidated input for --organization and --base-url parameters is passed to a Python eval() call before proper authorization checks. This allows any authenticated user to read server environment variables and cause denial of service through memory exhaustion.

Detection Guidance

Detect this vulnerability by checking FreeIPA server logs for unusual idp-add command usage with --organization or --base-url parameters. Look for eval() related errors or memory exhaustion events. No specific commands are provided in the context, but monitor for unauthorized LDAP queries or process crashes.

Impact Analysis

An attacker could extract sensitive environment variables from the server process, potentially exposing credentials or configuration details. They could also crash the server by triggering memory exhaustion, disrupting services. The impact depends on deployment: standard installations may expose limited data, while container deployments could expose critical passwords.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of environment variables may include credentials or personal data, triggering compliance breaches. Denial of service impacts availability, another key requirement for these standards.

Mitigation Strategies

Immediately upgrade FreeIPA to a patched version as no configuration-based workaround exists. For container deployments, verify that sensitive credentials like Directory Manager passwords are not exposed in the process environment. Restrict authenticated IPA principal access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79678. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart