CVE-2026-76578

DOCUMENTATION: A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services. 

            STATEMENT: This is a Critical flaw allowing complete, unauthenticated compromise of a FreeIPA/IdM server's administrative privileges. The technique originally disclosed impersonated the literal admin account via a canonical-name collision; a separate prior fix (CVE-2026-13097) now blocks that specific collision but does not address the underlying unauthenticated write access. The attack still succeeds by having the anonymously-created principal added to the administrators group under an attacker-chosen name, reaching the same practical outcome. Exploitation of the original collision-based technique has been independently confirmed by Red Hat against a default, unmodified FreeIPA installation and requires no credentials, user interaction, or prior access, only network reachability to the LDAP service. Any FreeIPA/IdM deployment exposing LDAP to an untrusted network should be considered at immediate risk until patched.

            MITIGATION: Until a fixed package is available, restrict network access to the LDAP service (typically ports 389/636) to trusted hosts only, using firewall rules or network segmentation. Disabling anonymous LDAP binds blocks this specific attack path, though administrators should confirm this does not break other required anonymous-bind functionality in their deployment before applying it.