FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials
A critical vulnerability in FreeIPA, combined with a separate flaw in 389 Directory Server, allows an unauthenticated attacker to create a Kerberos identity and gain administrator privileges. The attack chain involves creating a Kerberos name that matches an existing administrator account, bypassing existing security measures. Red Hat has released patches for both flaws, and recommends temporary mitigations like restricting LDAP access until updates are applied.
A critical vulnerability in FreeIPA, alongside a separate flaw in 389 Directory Server, is enabling unauthenticated attackers to gain administrator privileges. The issue stems from a chain of events where an attacker can create a Kerberos identity and inject it into the administrators group, effectively impersonating an administrator. This is possible because of a second flaw in 389 Directory Server, which allows an attacker to bypass a permission check and inject an identity, even if it already exists.
FreeIPA is the system that determines who may log in across a Linux domain and maintains all identities in a 389 Directory Server database accessed via LDAP. The attack requires a second flaw in 389 Directory Server, where a rule type meant to say "only the authenticated owner of this entry" compares the client's name against a stored value as plain text. An unauthenticated client can create a token entry with the ownership fields left blank, pass the ownership check by being nobody, and write a Kerberos identity and password alongside it.
Red Hat tracks the FreeIPA flaw as CVE-2026-76578 and rates it critical, with a CVSS score of 9.8. The same page says that score is preliminary and subject to review. Red Hat ships FreeIPA as its Identity Management product, where the package is called ipa. The FreeIPA project puts it more narrowly, stating that the injected identity must not already exist, that the CVE-2026-13097 fix prevents existing accounts from being taken over, and that the attack "may be used as a stepping stone" to administrative privileges.
Red Hat says it ran the chain against a stock FreeIPA container image running version 4.13.1 and checked the results with standard administrator-only commands rather than trusting the exploit's output. The published material leaves two questions unanswered. Neither Red Hat nor the FreeIPA project says whether 389-ds updates, on their own, stop the FreeIPA attack on a server whose ipa packages are still outdated. And neither says whether applying a fix removes an identity an attacker created beforehand, or what an administrator should look for to find out.
Red Hat has released patches for both flaws, and recommends two temporary mitigations until updates are applied: restricting access to the LDAP service (typically ports 389 and 636) to hosts you trust, and turning off anonymous LDAP binds. For the idp-add flaw, there is no such option. Red Hat says no configuration setting keeps an ordinary authenticated account away from that code, and that a fixed package is required.