ELSA-2026-83460 — Critical: idm:DL1 security, bug fix, and enhancement update (Oracle Linux 8)

Summary

bind-dyndb-ldap
[11.6-6]
- Fix rpminspect warnings
Resolves: RHEL-22497

custodia
[0.6.0-3]
- Require platform-python-setuptools instead of python3-setuptools
- Resolves: rhbz#1650508

ipa
[4.9.13-21.3.0.2]
- Set IPAPLATFORM=rhel when build on Oracle Linux [Orabug: 29516674]

[4.9.13-21.3]
- Updated the application() function in install/migration/migration.py to resolve the error.
- CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read
Resolves: RHEL-240819

[4.9.13-21.2]
- Fix ipatests for kdcproxy after CVE-2025-59088 fix
Resolves: RHEL-129966
- CVE-2026-18147 idm:DL1/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
Resolves: RHEL-218850
- CVE-2026-18147 idm:client/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
Resolves: RHEL-218856
- CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read
Resolves: RHEL-240798
- CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read
Resolves: RHEL-240819
- CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
Resolves: RHEL-240840
- CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
Resolves: RHEL-240905
- CVE-2026-76578 idm:DL1/ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
Resolves: RHEL-245481
- CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
Resolves: RHEL-245621
- CVE-2026-79678 idm:DL1/ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
Resolves: RHEL-255682

[4.9.13-21.1]
- Fix ipatests for kdcproxy after CVE-2025-59088 fix
Resolves: RHEL-129966
- CVE-2026-18147 idm:DL1/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
Resolves: RHEL-218850
- CVE-2026-18147 idm:client/ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL
Resolves: RHEL-218856
- CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read
Resolves: RHEL-240798
- CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read
Resolves: RHEL-240819
- CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
Resolves: RHEL-240840
- CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
Resolves: RHEL-240905
- CVE-2026-76578 idm:DL1/ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
Resolves: RHEL-245481
- CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
Resolves: RHEL-245621
- CVE-2026-79678 idm:DL1/ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
Resolves: RHEL-255682

ipa-healthcheck
[0.12-6]
- Don't rely on order in trust roles (RHEL-99487)

opendnssec
[2.1.7-2]
- Don't creat /var/run/opendnssec directory
- Resolves: RHEL-12163

python-jwcrypto
[0.5.0-2]
- Address potential DoS with high compression ratio
Resolves: RHEL-28697
- Limit number of iterations for PBES
Resolves: RHEL-23036 RHEL-23037

python-kdcproxy
[0.4-5.2]
- Use DNS discovery for declared realms only (CVE-2025-59088)
Resolves: RHEL-113657
- Fix DoS vulnerability based on unbounded TCP buffering (CVE-2025-59089)
Resolves: RHEL-113664

python-qrcode
[5.3-1]
- Resolves: RHEL-15090 Generation of image file fails with Python 3

python-yubico
[1.3.2-9.1]
- Rebuilt to fix NVR issue (#2097803)

pyusb
[1.0.0-9.1]
- Rebuilt to fix the NVR issue (#2094880)

slapi-nis
[0.60.0-4]
- Ignore updates from non-tracked subtrees during modify/modrdn/update
to avoid deadlocks with retro changelog
- Resolves: RHEL-5134

softhsm
[2.6.0-5]
- Install prever devel package requirements for new negative option patch
Related: RHBZ#1857272

Fixed packages 30

Release	Package	Fixed in
Oracle Linux · 8	bind-dyndb-ldap	0:11.6-6.module+el8.10.0+90553+1bd85afa
Oracle Linux · 8	custodia	0:0.6.0-3.module+el8.9.0+90094+20819f5a
Oracle Linux · 8	ipa-client	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	ipa-client-common	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	ipa-client-epn	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	ipa-client-samba	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	ipa-common	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	ipa-healthcheck	0:0.12-6.module+el8.10.0+91065+f06407c0
Oracle Linux · 8	ipa-healthcheck-core	0:0.12-6.module+el8.10.0+91065+f06407c0
Oracle Linux · 8	ipa-python-compat	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	ipa-selinux	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	ipa-server	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	ipa-server-common	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	ipa-server-dns	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	ipa-server-trust-ad	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	opendnssec	0:2.1.7-2.module+el8.10.0+90553+1bd85afa
Oracle Linux · 8	python3-custodia	0:0.6.0-3.module+el8.9.0+90094+20819f5a
Oracle Linux · 8	python3-ipaclient	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	python3-ipalib	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	python3-ipaserver	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	python3-ipatests	0:4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3
Oracle Linux · 8	python3-jwcrypto	0:0.5.0-2.module+el8.10.0+90573+7d6bd8da
Oracle Linux · 8	python3-kdcproxy	0:0.4-5.module+el8.10.0+90703+a2faa53f.2
Oracle Linux · 8	python3-pyusb	0:1.0.0-9.1.module+el8.9.0+90094+20819f5a
Oracle Linux · 8	python3-qrcode	0:5.3-1.module+el8.10.0+91065+f06407c0
Oracle Linux · 8	python3-qrcode-core	0:5.3-1.module+el8.10.0+91065+f06407c0
Oracle Linux · 8	python3-yubico	0:1.3.2-9.1.module+el8.9.0+90094+20819f5a
Oracle Linux · 8	slapi-nis	0:0.60.0-4.module+el8.10.0+90297+bfe93ccc
Oracle Linux · 8	softhsm	0:2.6.0-5.module+el8.9.0+90094+20819f5a
Oracle Linux · 8	softhsm-devel	0:2.6.0-5.module+el8.9.0+90094+20819f5a

Vulnerabilities 8

Critical 9.8

CVE-2026-76578 Public exploit

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the und…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu

Sep 7, 2026
Critical 9.6

CVE-2026-11861

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by imperso…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu

Aug 20, 2026
High 8.7

CVE-2026-13097

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu

Aug 20, 2026
High 8.2

CVE-2026-19550

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trus…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu

Aug 11, 2026
High 8.1

CVE-2026-18147

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, t…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu

Sep 9, 2026
High 8.1

CVE-2026-79678

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regard…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu

Sep 7, 2026
High 7.5

CVE-2026-73197

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodi…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu

Aug 20, 2026
High 7.5

CVE-2026-73198

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu

Aug 20, 2026

Critical: idm:DL1 security, bug fix, and enhancement update (Oracle Linux 8)

Summary

Fixed packages 30

Vulnerabilities 8

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read