Critical FreeIPA Flaw Chain Lets Attackers Forge Admin Credentials

A pair of chained vulnerabilities in FreeIPA and the 389 Directory Server can allow an anonymous, never-logged-in client to manufacture a Kerberos identity of its choosing and land in the administrators group on a default Linux domain installation. Red Hat rates the FreeIPA flaw, tracked as CVE-2026-76578, as critical with a preliminary CVSS score of 9.8, and has shipped a fix in FreeIPA version 4.13.4. The company said it reproduced the full chain twice on stock installations, including a fully air-gapped machine.

The first half of the chain is an access control instruction (ACI) that FreeIPA ships by default to let users manage their own one-time-password tokens. That ACI does not require prior authentication and imposes no restrictions on what additional attributes can be written alongside the token. The second half lives inside 389 Directory Server itself, tracked as CVE-2026-76560 with a CVSS of 7.5. Its access-control engine evaluates a rule meant to restrict changes to the authenticated entry owner by performing a plain-text name comparison. Because an anonymous client has an empty principal name, the check silently matches a blank ownership field, letting the unauthenticated write sail through. Red Hat confirmed the defect reproduces on a plain 389-ds build with no FreeIPA installed, placing the bug in the access-control engine rather than in anything FreeIPA itself does. Deployers who want to verify the exposure surface on their identity hosts can scan them with a port scanner and validate TLS posture on LDAP endpoints using an SSL/TLS checker.

The practical impact is full domain takeover. After the unauthenticated write lands, the attacker can set a Kerberos principal name and password of their choice, enroll that principal in the admins group, and authenticate as a domain administrator. Red Hat noted that an earlier fix, CVE-2026-13097 (patched in FreeIPA 4.13.3), only stopped attackers from impersonating the literal name of an existing admin; the underlying unauthenticated write path was left intact, so the same outcome is reachable under any name the attacker picks. Organizations running Red Hat Identity Management should treat the FreeIPA flaw as critical-priority and upgrade to 4.13.4, audit for any newly created privileged Kerberos principals since exposure, and rotate domain administrator credentials. With new Kerberos passwords in play, administrators should validate strength against known breach corpora using a password checker before reissuing credentials.