critical9.8
CVE-2026-76578
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and...
Impact
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | All versions Version patch: 0:4.13.4-1.el10_2 |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | All versions Version patch: 0:4.12.2-15.el10_0.7 |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | All versions |
| Red Hat | Red Hat Enterprise Linux 8 | All versions Versions patch: 8100020261007070536.823393f5, patch: 8100020261007071200.143e9e98 |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | All versions Versions patch: 8040020261027121355.5b01ab7e, patch: 8040020261027121250.f153676a |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | All versions Versions patch: 8040020261027121355.5b01ab7e, patch: 8040020261027121250.f153676a |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | All versions Versions patch: 8060020261008134123.c1533a64, patch: 8060020261008133528.ada582f1 |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | All versions Versions patch: 8060020261008133528.ada582f1, patch: 8060020261008134123.c1533a64 |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions | Versions patch: 8080020261007071832.b0a6ceea, patch: 8080020261007080925.e581a9e4 |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions | Version patch: 0:4.10.1-12.el9_2.7 |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | Versions patch: 8080020261007071832.b0a6ceea, patch: 8080020261007080925.e581a9e4 |
| Red Hat | Red Hat Enterprise Linux 9 | Version patch: 0:4.13.4-1.el9_8 |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | Version patch: 0:4.12.2-14.el9_6.8 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2026:70564
- https://access.redhat.com/errata/RHSA-2026:72279
- https://access.redhat.com/errata/RHSA-2026:82935
- https://access.redhat.com/errata/RHSA-2026:83083
- https://access.redhat.com/errata/RHSA-2026:83084
- https://access.redhat.com/errata/RHSA-2026:83085
- https://access.redhat.com/errata/RHSA-2026:83460
- https://access.redhat.com/errata/RHSA-2026:83461
- https://access.redhat.com/errata/RHSA-2026:89836
- https://access.redhat.com/errata/RHSA-2026:93071
- https://access.redhat.com/security/cve/CVE-2026-76578
- https://bugzilla.redhat.com/show_bug.cgi?id=2519522
- https://access.redhat.com/errata/RHSA-2026:93452
- https://github.com/advisories/GHSA-cgrx-2q4j-9f37
- https://nvd.nist.gov/vuln/detail/CVE-2026-76578