FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials
A critical flaw chain (CVE-2026-76578, CVSS 9.8) allows unauthenticated clients to create arbitrary Kerberos identities and inject themselves into the administrators group in FreeIPA deployments The attack exploits a combination of FreeIPA's overly permissive ACI rule and a 389 Directory Server access-control engine bug (CVE-2026-76560, CVSS 7.5) where empty client names match empty stored ownership values A second independent flaw (CVE-2026-79678, CVSS 8.1) exposes environment variables through
Analysis
TL;DR
- A critical flaw chain (CVE-2026-76578, CVSS 9.8) allows unauthenticated clients to create arbitrary Kerberos identities and inject themselves into the administrators group in FreeIPA deployments
- The attack exploits a combination of FreeIPA's overly permissive ACI rule and a 389 Directory Server access-control engine bug (CVE-2026-76560, CVSS 7.5) where empty client names match empty stored ownership values
- A second independent flaw (CVE-2026-79678, CVSS 8.1) exposes environment variables through a Python eval() call in the idp-add command, potentially leaking container deployment credentials
- The FreeIPA project has released version 4.13.4 addressing both FreeIPA-side issues, while Red Hat published 14 advisories for 389-ds-base covering multiple related flaws
- No evidence of real-world exploitation has been reported, but the chain works against default installations with no prior authentication required
Why It Matters
This flaw chain demonstrates how seemingly minor access-control misconfigurations in identity management systems can cascade into full administrative compromise, a scenario directly relevant to any organization relying on FreeIPA for Linux domain authentication. The vulnerability affects default configurations out of the box, meaning organizations may be exposed without any custom hardening or misconfiguration on their part.
Technical Details
- Flaw Chain Mechanism: FreeIPA's ACI rule allows users to manage one-time-password tokens without authentication and without restricting what else can be written alongside the token. Combined with a 389 Directory Server bug where the "authenticated owner" rule compares client names as plain text, an anonymous client (with an empty name) matches an empty stored ownership value, bypassing the access control check entirely.
- Attack Execution: An unauthenticated client creates a token entry with blank ownership fields, passes the ownership check by virtue of being "nobody," and simultaneously writes a Kerberos identity and password under an attacker-chosen name, granting administrative group membership and reusable credentials.
- CVE-2026-79678 (idp-add eval flaw): The
idp-addcommand passes caller-supplied organization name and base URL values into a Pythoneval()call before the permission check runs, allowing any account to trigger it. While brackets are forbidden (preventing direct code execution), attackers can enumerate environment variables through error messages and cause memory exhaustion via arithmetic expressions. - Container-Specific Risk: Official FreeIPA server images often pass Directory Manager and administrator passwords as environment variables at first boot; if these persist post-setup, the eval flaw can leak them.
- Patch Status: FreeIPA 4.13.4 fixes both FreeIPA-side flaws. Red Hat published 14 advisories for 389-ds-base on September 8, with RHSA-2026:64785 covering RHEL 10 (
389-ds-base-3.2.0-10.el10_2). The directory server flaw was independently reproduced on a plain 389-ds build, confirming it resides in the access-control engine rather than FreeIPA-specific code.
Industry Insight
- Organizations running FreeIPA should prioritize patching to version 4.13.4 immediately, especially those using containerized deployments where credential leakage via the eval flaw is a compounding risk.
- The incident highlights the importance of reviewing default access control configurations in identity management systems; the FreeIPA ACI rule shipped by default was sufficiently permissive to enable the attack chain without any administrator customization.
- Security teams should audit container images for lingering environment variables post-deployment, as the idp-add flaw makes this a practical defense-in-depth measure beyond just patching the software.
Disclaimer: The above content is generated by AI and is for reference only.