NetSight
IP …
high8.7

CVE-2026-13097

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

Impact

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

Affected products

VendorProductAffected versions
RedhatEnterprise Linux
Versions 7.0, 8.0, 9.0, 10.0
FreeipaFreeipa
Version 4.12.2
Red HatRed Hat Enterprise Linux 10
All versions
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
All versions
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support
All versions
Red HatRed Hat Enterprise Linux 8
All versions
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
All versions
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
All versions
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
All versions
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
All versions

Weakness classification

CWE-706

References