Description
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freeipa | No fix yet | — |
| Debian 13 | freeipa | No fix yet | — |
| Debian 12 | freeipa | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | freeipa | No fix yet | — |
| Ubuntu 26.04 LTS | freeipa | No fix yet | — |
| Ubuntu 24.04 LTS | freeipa | No fix yet | — |
| Ubuntu 22.04 LTS | freeipa | No fix yet | — |
| Ubuntu 20.04 LTS | freeipa | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | freeipa | No fix yet | — |
| Ubuntu Pro 16.04 LTS | freeipa | No fix yet | — |
| Ubuntu Pro 14.04 LTS | freeipa | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | ipa +18 | 4.13.4-1.el10_2 | RHSA-2026:72279 |
| RHEL 9 | ipa +18 | 4.13.4-1.el9_8 | RHSA-2026:70564 |
| RHEL 8 | bind-dyndb-ldap | 11.6-6.module+el8.10.0+23009+91fb337e | RHSA-2026:83460 |
| RHEL 8 | custodia +1 | 0.6.0-3.module+el8.9.0+18911+94941f82 | RHSA-2026:83460 |
| RHEL 8 | ipa +9 | 4.9.13-21.module+el8.10.0+25042+a3bddcd5.3 | RHSA-2026:83460 |
| RHEL 8 | ipa-healthcheck +1 | 0.12-6.module+el8.10.0+23404+f6b3454f | RHSA-2026:83460 |
| RHEL 8 | ipa-server +5 | 4.9.13-21.module+el8.10.0+25041+701625f4.3 | RHSA-2026:83460 |
| RHEL 8 | opendnssec | 2.1.7-2.module+el8.10.0+22913+7aa1a207 | RHSA-2026:83460 |
| RHEL 8 | python-jwcrypto +1 | 0.5.0-2.module+el8.10.0+21692+c9b201bc | RHSA-2026:83460 |
| RHEL 8 | python-kdcproxy +1 | 0.4-5.module+el8.10.0+23610+7d6e87e5.2 | RHSA-2026:83460 |
| RHEL 8 | python-qrcode +2 | 5.3-1.module+el8.10.0+22544+6a7f07c2 | RHSA-2026:83460 |
| RHEL 8 | python-yubico +1 | 1.3.2-9.1.module+el8.9.0+18920+2223d05e | RHSA-2026:83460 |
| RHEL 8 | pyusb +1 | 1.0.0-9.1.module+el8.9.0+18920+2223d05e | RHSA-2026:83460 |
| RHEL 8 | slapi-nis | 0.60.0-4.module+el8.10.0+20723+03062ebd | RHSA-2026:83460 |
| RHEL 8 | softhsm +1 | 2.6.0-5.module+el8.9.0+18911+94941f82 | RHSA-2026:83460 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | ipa +18 | 4.12.2-15.el10_0.7 | RHSA-2026:82935 |
| RHEL 9.6 EUS | ipa +18 | 4.12.2-14.el9_6.8 | RHSA-2026:83083 |
| RHEL 9.4 E4S | ipa +13 | 4.11.0-15.el9_4.9 | RHSA-2026:83084 |
| RHEL 9.2 E4S | ipa +13 | 4.10.1-12.el9_2.7 | RHSA-2026:83085 |
| RHEL 8.8 TUS | bind-dyndb-ldap | 11.6-4.module+el8.8.0+21675+157fa23b.2 | RHSA-2026:83461 |
| RHEL 8.8 TUS | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2026:83461 |
| RHEL 8.8 TUS | ipa +9 | 4.9.11-11.module+el8.8.0+25045+e21657cc.6 | RHSA-2026:83461 |
| RHEL 8.8 TUS | ipa-healthcheck +1 | 0.12-1.module+el8.8.0+17583+8c783c60 | RHSA-2026:83461 |
| RHEL 8.8 TUS | ipa-server +5 | 4.9.11-11.module+el8.8.0+25043+cab6964c.6 | RHSA-2026:83461 |
| RHEL 8.8 TUS | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2026:83461 |
| RHEL 8.8 TUS | python-jwcrypto +1 | 0.5.0-1.1.module+el8.7.0+15888+685a878f | RHSA-2026:83461 |
| RHEL 8.8 TUS | python-kdcproxy +1 | 0.4-5.module+el8.8.0+24989+289c67e6.1 | RHSA-2026:83461 |
| RHEL 8.8 TUS | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2026:83461 |
| RHEL 8.8 TUS | python-yubico +1 | 1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2026:83461 |
| RHEL 8.8 TUS | pyusb +1 | 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2026:83461 |
| RHEL 8.8 TUS | slapi-nis | 0.60.0-4.module+el8.8.0+20635+330e3683 | RHSA-2026:83461 |
| RHEL 8.8 TUS | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2026:83461 |
| RHEL 8.8 E4S | bind-dyndb-ldap | 11.6-4.module+el8.8.0+21675+157fa23b.2 | RHSA-2026:83461 |
| RHEL 8.8 E4S | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2026:83461 |
| RHEL 8.8 E4S | ipa +9 | 4.9.11-11.module+el8.8.0+25045+e21657cc.6 | RHSA-2026:83461 |
| RHEL 8.8 E4S | ipa-healthcheck +1 | 0.12-1.module+el8.8.0+17583+8c783c60 | RHSA-2026:83461 |
| RHEL 8.8 E4S | ipa-server +5 | 4.9.11-11.module+el8.8.0+25043+cab6964c.6 | RHSA-2026:83461 |
| RHEL 8.8 E4S | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2026:83461 |
| RHEL 8.8 E4S | python-jwcrypto +1 | 0.5.0-1.1.module+el8.7.0+15888+685a878f | RHSA-2026:83461 |
| RHEL 8.8 E4S | python-kdcproxy +1 | 0.4-5.module+el8.8.0+24989+289c67e6.1 | RHSA-2026:83461 |
| RHEL 8.8 E4S | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2026:83461 |
| RHEL 8.8 E4S | python-yubico +1 | 1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2026:83461 |
| RHEL 8.8 E4S | pyusb +1 | 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2026:83461 |
| RHEL 8.8 E4S | slapi-nis | 0.60.0-4.module+el8.8.0+20635+330e3683 | RHSA-2026:83461 |
| RHEL 8.8 E4S | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2026:83461 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | ipa-client +17 | 4.13.4-1.el10_2 | ALSA-2026:72279 |
| AlmaLinux 9 | ipa-client +17 | 4.13.4-1.el9_8 | ALSA-2026:70564 |
| AlmaLinux 8 | bind-dyndb-ldap | 11.6-6.module_el8.10.0+3980+d78e8e90 | ALSA-2026:83460 |
| AlmaLinux 8 | custodia +1 | 0.6.0-3.module_el8.6.0+2881+2f24dc92 | ALSA-2026:83460 |
| AlmaLinux 8 | ipa-client +14 | 4.9.13-21.module_el8.10.0+4302+2d2000af.3 | ALSA-2026:83460 |
| AlmaLinux 8 | ipa-healthcheck +1 | 0.12-6.module_el8.10.0+4036+84b152d9 | ALSA-2026:83460 |
| AlmaLinux 8 | opendnssec | 2.1.7-2.module_el8.10.0+3980+d78e8e90 | ALSA-2026:83460 |
| AlmaLinux 8 | python3-jwcrypto | 0.5.0-2.module_el8.10.0+3844+20e075e5 | ALSA-2026:83460 |
| AlmaLinux 8 | python3-kdcproxy | 0.4-5.module_el8.10.0+4069+1d9eaa78.2 | ALSA-2026:83460 |
| AlmaLinux 8 | python3-pyusb | 1.0.0-9.1.module_el8.7.0+3349+cfeff52e | ALSA-2026:83460 |
| AlmaLinux 8 | python3-qrcode +1 | 5.3-1.module_el8.10.0+3942+63b39a46 | ALSA-2026:83460 |
| AlmaLinux 8 | python3-yubico | 1.3.2-9.1.module_el8.7.0+3349+cfeff52e | ALSA-2026:83460 |
| AlmaLinux 8 | slapi-nis | 0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1 | ALSA-2026:83460 |
| AlmaLinux 8 | softhsm +1 | 2.6.0-5.module_el8.6.0+2881+2f24dc92 | ALSA-2026:83460 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ipa | 4.13.4-1.el10_2 | RLSA-2026:72279 |
| Rocky Linux 9 | ipa | 4.13.4-1.el9_8 | RLSA-2026:70564 |
| Rocky Linux 8 | bind-dyndb-ldap | 11.6-6.module+el8.10.0+1960+1ed527b3 | RLSA-2026:83460 |
| Rocky Linux 8 | custodia | 0.6.0-3.module+el8.9.0+1371+ffa84eb9 | RLSA-2026:83460 |
| Rocky Linux 8 | ipa | 4.9.13-21.module+el8.10.0+40089+03bf3c1f | RLSA-2026:83460 |
| Rocky Linux 8 | ipa-healthcheck | 0.12-6.module+el8.10.0+2053+a0a9dc19 | RLSA-2026:83460 |
| Rocky Linux 8 | opendnssec | 2.1.7-2.module+el8.10.0+1960+1ed527b3 | RLSA-2026:83460 |
| Rocky Linux 8 | python-jwcrypto | 0.5.0-2.module+el8.10.0+1818+2dfda7a6 | RLSA-2026:83460 |
| Rocky Linux 8 | python-kdcproxy | 0.4-5.module+el8.9.0+1371+ffa84eb9 | RLSA-2026:83460 |
| Rocky Linux 8 | python-qrcode | 5.3-1.module+el8.10.0+1915+3c70f7d9 | RLSA-2026:83460 |
| Rocky Linux 8 | python-yubico | 1.3.2-9.1.module+el8.9.0+1371+ffa84eb9 | RLSA-2026:83460 |
| Rocky Linux 8 | pyusb | 1.0.0-9.1.module+el8.9.0+1371+ffa84eb9 | RLSA-2026:83460 |
| Rocky Linux 8 | slapi-nis | 0.60.0-4.module+el8.9.0+1573+39ab85f4 | RLSA-2026:83460 |
| Rocky Linux 8 | softhsm | 2.6.0-5.module+el8.9.0+1371+ffa84eb9 | RLSA-2026:83460 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | ipa-client +10 | 4.6.8-5.amzn2.17.5 | ALAS2-2026-3877 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | ipa-client +17 | 4.13.4-1.0.1.el10_2 | ELSA-2026-72279 |
| Oracle Linux 9 | ipa-client +17 | 4.13.4-1.0.1.el9_8 | ELSA-2026-70564 |
| Oracle Linux 8 | bind-dyndb-ldap | 11.6-6.module+el8.10.0+90553+1bd85afa | ELSA-2026-83460 |
| Oracle Linux 8 | custodia +1 | 0.6.0-3.module+el8.9.0+90094+20819f5a | ELSA-2026-83460 |
| Oracle Linux 8 | ipa-client +14 | 4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3 | ELSA-2026-83460 |
| Oracle Linux 8 | ipa-healthcheck +1 | 0.12-6.module+el8.10.0+91065+f06407c0 | ELSA-2026-83460 |
| Oracle Linux 8 | opendnssec | 2.1.7-2.module+el8.10.0+90553+1bd85afa | ELSA-2026-83460 |
| Oracle Linux 8 | python3-jwcrypto | 0.5.0-2.module+el8.10.0+90573+7d6bd8da | ELSA-2026-83460 |
| Oracle Linux 8 | python3-kdcproxy | 0.4-5.module+el8.10.0+90703+a2faa53f.2 | ELSA-2026-83460 |
| Oracle Linux 8 | python3-pyusb | 1.0.0-9.1.module+el8.9.0+90094+20819f5a | ELSA-2026-83460 |
| Oracle Linux 8 | python3-qrcode +1 | 5.3-1.module+el8.10.0+91065+f06407c0 | ELSA-2026-83460 |
| Oracle Linux 8 | python3-yubico | 1.3.2-9.1.module+el8.9.0+90094+20819f5a | ELSA-2026-83460 |
| Oracle Linux 8 | slapi-nis | 0.60.0-4.module+el8.10.0+90297+bfe93ccc | ELSA-2026-83460 |
| Oracle Linux 8 | softhsm +1 | 2.6.0-5.module+el8.9.0+90094+20819f5a | ELSA-2026-83460 |
Advisories 19
- WID-SEC-2026-3552 Red Hat Enterprise Linux (FreeIPA): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 1, 2026
- ALSA-2026:72279 Critical: ipa security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:70564 Critical: ipa security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:83460 Critical: idm:DL1 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:83460 Red Hat Security Advisory: idm:DL1 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:83461 Red Hat Security Advisory: idm:DL1 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:83084 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:83085 Red Hat Security Advisory: ipa security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:83083 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:82935 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72279 Red Hat Security Advisory: ipa security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:70564 Red Hat Security Advisory: ipa security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RLSA-2026:83460 Critical: idm:DL1 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 15, 2026
- ELSA-2026-83460 Critical: idm:DL1 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 15, 2026
- RLSA-2026:72279 Critical: ipa security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 29, 2026
- ELSA-2026-72279 Critical: ipa security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Sep 28, 2026
- RLSA-2026:70564 Critical: ipa security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 24, 2026
- ELSA-2026-70564 Critical: ipa security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 24, 2026
- ALAS2-2026-3877 Critical: ipa security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 25, 2026
References
- RHSA-2026:70564 vendor-advisory
- RHSA-2026:72279 vendor-advisory
- RHSA-2026:82935 vendor-advisory
- RHSA-2026:83083 vendor-advisory
- RHSA-2026:83084 vendor-advisory
- RHSA-2026:83085 vendor-advisory
- RHSA-2026:83460 vendor-advisory
- RHSA-2026:83461 vendor-advisory
- RHSA-2026:89836 vendor-advisory
- RHSA-2026:93071 vendor-advisory
- RHSA-2026:93452 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-13097 vdb-entry
- RHBZ#2515974 issue-tracking