FreeIPA Flaw Chain Allows Anonymous Clients to Create Administrator Credentials

Critical FreeIPA Vulnerability Discovered

A critical vulnerability, identified as CVE-2026-76578, has been found in FreeIPA, a system used for identity management across Linux domains. This flaw allows a client that has not logged in to create a Kerberos identity of its choosing within the directory and subsequently gain administrator privileges. Red Hat has rated this FreeIPA flaw as critical, with a preliminary CVSS score of 9.8.

Two-Part Flaw Chain

The exploit chain requires two distinct flaws to be present. The first is within FreeIPA's access control rule (ACI) that permits users to manage their own one-time-password tokens without prior login. This rule does not restrict what other data can be written alongside the token. The second flaw resides in the 389 Directory Server, which FreeIPA uses for its identity database. This flaw, tracked as CVE-2026-76560 (CVSS 7.5), incorrectly processes ownership checks for unauthenticated clients, allowing them to bypass authentication by having an empty name match an empty stored value.

Impact on Default Installations

Red Hat confirmed that this flaw chain can be reproduced on a default FreeIPA installation. The default access control rule shipped with FreeIPA is precisely the type that exposes the 389 Directory Server vulnerability, making untouched installations susceptible. While the 389 Directory Server flaw on its own only affects deployments with specific custom rules, FreeIPA's default configuration makes it vulnerable.

Resolution and Background

The FreeIPA project has already addressed its part of the vulnerability in version 4.13.4. Red Hat also independently reproduced the 389 Directory Server defect, confirming it lies within the access-control engine of the directory server itself, not in FreeIPA's specific implementation. An earlier fix for CVE-2026-13097 prevented impersonation of existing admin accounts but did not resolve the underlying unauthenticated access issue.