Description
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freeipa | No fix yet | — |
| Debian 13 | freeipa | No fix yet | — |
| Debian 12 | freeipa | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | freeipa | No fix yet | — |
| Ubuntu 26.04 LTS | freeipa | No fix yet | — |
| Ubuntu 24.04 LTS | freeipa | No fix yet | — |
| Ubuntu 22.04 LTS | freeipa | No fix yet | — |
| Ubuntu 20.04 LTS | freeipa | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | freeipa | No fix yet | — |
| Ubuntu Pro 16.04 LTS | freeipa | No fix yet | — |
| Ubuntu Pro 14.04 LTS | freeipa | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | ipa +18 | 4.13.4-1.el10_2 | RHSA-2026:72279 |
| RHEL 9 | ipa +18 | 4.13.4-1.el9_8 | RHSA-2026:70564 |
| RHEL 8 | bind-dyndb-ldap | 11.6-6.module+el8.10.0+23009+91fb337e | RHSA-2026:83460 |
| RHEL 8 | custodia +1 | 0.6.0-3.module+el8.9.0+18911+94941f82 | RHSA-2026:83460 |
| RHEL 8 | ipa +9 | 4.9.13-21.module+el8.10.0+25042+a3bddcd5.3 | RHSA-2026:83460 |
| RHEL 8 | ipa-healthcheck +1 | 0.12-6.module+el8.10.0+23404+f6b3454f | RHSA-2026:83460 |
| RHEL 8 | ipa-server +5 | 4.9.13-21.module+el8.10.0+25041+701625f4.3 | RHSA-2026:83460 |
| RHEL 8 | opendnssec | 2.1.7-2.module+el8.10.0+22913+7aa1a207 | RHSA-2026:83460 |
| RHEL 8 | python-jwcrypto +1 | 0.5.0-2.module+el8.10.0+21692+c9b201bc | RHSA-2026:83460 |
| RHEL 8 | python-kdcproxy +1 | 0.4-5.module+el8.10.0+23610+7d6e87e5.2 | RHSA-2026:83460 |
| RHEL 8 | python-qrcode +2 | 5.3-1.module+el8.10.0+22544+6a7f07c2 | RHSA-2026:83460 |
| RHEL 8 | python-yubico +1 | 1.3.2-9.1.module+el8.9.0+18920+2223d05e | RHSA-2026:83460 |
| RHEL 8 | pyusb +1 | 1.0.0-9.1.module+el8.9.0+18920+2223d05e | RHSA-2026:83460 |
| RHEL 8 | slapi-nis | 0.60.0-4.module+el8.10.0+20723+03062ebd | RHSA-2026:83460 |
| RHEL 8 | softhsm +1 | 2.6.0-5.module+el8.9.0+18911+94941f82 | RHSA-2026:83460 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | ipa +18 | 4.12.2-15.el10_0.7 | RHSA-2026:82935 |
| RHEL 9.6 EUS | ipa +18 | 4.12.2-14.el9_6.8 | RHSA-2026:83083 |
| RHEL 9.4 E4S | ipa +13 | 4.11.0-15.el9_4.9 | RHSA-2026:83084 |
| RHEL 9.2 E4S | ipa +13 | 4.10.1-12.el9_2.7 | RHSA-2026:83085 |
| RHEL 8.8 TUS | bind-dyndb-ldap | 11.6-4.module+el8.8.0+21675+157fa23b.2 | RHSA-2026:83461 |
| RHEL 8.8 TUS | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2026:83461 |
| RHEL 8.8 TUS | ipa +9 | 4.9.11-11.module+el8.8.0+25045+e21657cc.6 | RHSA-2026:83461 |
| RHEL 8.8 TUS | ipa-healthcheck +1 | 0.12-1.module+el8.8.0+17583+8c783c60 | RHSA-2026:83461 |
| RHEL 8.8 TUS | ipa-server +5 | 4.9.11-11.module+el8.8.0+25043+cab6964c.6 | RHSA-2026:83461 |
| RHEL 8.8 TUS | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2026:83461 |
| RHEL 8.8 TUS | python-jwcrypto +1 | 0.5.0-1.1.module+el8.7.0+15888+685a878f | RHSA-2026:83461 |
| RHEL 8.8 TUS | python-kdcproxy +1 | 0.4-5.module+el8.8.0+24989+289c67e6.1 | RHSA-2026:83461 |
| RHEL 8.8 TUS | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2026:83461 |
| RHEL 8.8 TUS | python-yubico +1 | 1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2026:83461 |
| RHEL 8.8 TUS | pyusb +1 | 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2026:83461 |
| RHEL 8.8 TUS | slapi-nis | 0.60.0-4.module+el8.8.0+20635+330e3683 | RHSA-2026:83461 |
| RHEL 8.8 TUS | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2026:83461 |
| RHEL 8.8 E4S | bind-dyndb-ldap | 11.6-4.module+el8.8.0+21675+157fa23b.2 | RHSA-2026:83461 |
| RHEL 8.8 E4S | custodia +1 | 0.6.0-3.module+el8.1.0+4098+f286395e | RHSA-2026:83461 |
| RHEL 8.8 E4S | ipa +9 | 4.9.11-11.module+el8.8.0+25045+e21657cc.6 | RHSA-2026:83461 |
| RHEL 8.8 E4S | ipa-healthcheck +1 | 0.12-1.module+el8.8.0+17583+8c783c60 | RHSA-2026:83461 |
| RHEL 8.8 E4S | ipa-server +5 | 4.9.11-11.module+el8.8.0+25043+cab6964c.6 | RHSA-2026:83461 |
| RHEL 8.8 E4S | opendnssec | 2.1.7-1.module+el8.4.0+9007+5084bdd8 | RHSA-2026:83461 |
| RHEL 8.8 E4S | python-jwcrypto +1 | 0.5.0-1.1.module+el8.7.0+15888+685a878f | RHSA-2026:83461 |
| RHEL 8.8 E4S | python-kdcproxy +1 | 0.4-5.module+el8.8.0+24989+289c67e6.1 | RHSA-2026:83461 |
| RHEL 8.8 E4S | python-qrcode +2 | 5.1-12.module+el8.1.0+4107+4a66eb87 | RHSA-2026:83461 |
| RHEL 8.8 E4S | python-yubico +1 | 1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2026:83461 |
| RHEL 8.8 E4S | pyusb +1 | 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 | RHSA-2026:83461 |
| RHEL 8.8 E4S | slapi-nis | 0.60.0-4.module+el8.8.0+20635+330e3683 | RHSA-2026:83461 |
| RHEL 8.8 E4S | softhsm +1 | 2.6.0-5.module+el8.4.0+10227+076cd560 | RHSA-2026:83461 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | ipa-client +17 | 4.13.4-1.el10_2 | ALSA-2026:72279 |
| AlmaLinux 9 | ipa-client +17 | 4.13.4-1.el9_8 | ALSA-2026:70564 |
| AlmaLinux 8 | bind-dyndb-ldap | 11.6-6.module_el8.10.0+3980+d78e8e90 | ALSA-2026:83460 |
| AlmaLinux 8 | custodia +1 | 0.6.0-3.module_el8.6.0+2881+2f24dc92 | ALSA-2026:83460 |
| AlmaLinux 8 | ipa-client +14 | 4.9.13-21.module_el8.10.0+4302+2d2000af.3 | ALSA-2026:83460 |
| AlmaLinux 8 | ipa-healthcheck +1 | 0.12-6.module_el8.10.0+4036+84b152d9 | ALSA-2026:83460 |
| AlmaLinux 8 | opendnssec | 2.1.7-2.module_el8.10.0+3980+d78e8e90 | ALSA-2026:83460 |
| AlmaLinux 8 | python3-jwcrypto | 0.5.0-2.module_el8.10.0+3844+20e075e5 | ALSA-2026:83460 |
| AlmaLinux 8 | python3-kdcproxy | 0.4-5.module_el8.10.0+4069+1d9eaa78.2 | ALSA-2026:83460 |
| AlmaLinux 8 | python3-pyusb | 1.0.0-9.1.module_el8.7.0+3349+cfeff52e | ALSA-2026:83460 |
| AlmaLinux 8 | python3-qrcode +1 | 5.3-1.module_el8.10.0+3942+63b39a46 | ALSA-2026:83460 |
| AlmaLinux 8 | python3-yubico | 1.3.2-9.1.module_el8.7.0+3349+cfeff52e | ALSA-2026:83460 |
| AlmaLinux 8 | slapi-nis | 0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1 | ALSA-2026:83460 |
| AlmaLinux 8 | softhsm +1 | 2.6.0-5.module_el8.6.0+2881+2f24dc92 | ALSA-2026:83460 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ipa | 4.13.4-1.el10_2 | RLSA-2026:72279 |
| Rocky Linux 9 | ipa | 4.13.4-1.el9_8 | RLSA-2026:70564 |
| Rocky Linux 8 | bind-dyndb-ldap | 11.6-6.module+el8.10.0+1960+1ed527b3 | RLSA-2026:83460 |
| Rocky Linux 8 | custodia | 0.6.0-3.module+el8.9.0+1371+ffa84eb9 | RLSA-2026:83460 |
| Rocky Linux 8 | ipa | 4.9.13-21.module+el8.10.0+40089+03bf3c1f | RLSA-2026:83460 |
| Rocky Linux 8 | ipa-healthcheck | 0.12-6.module+el8.10.0+2053+a0a9dc19 | RLSA-2026:83460 |
| Rocky Linux 8 | opendnssec | 2.1.7-2.module+el8.10.0+1960+1ed527b3 | RLSA-2026:83460 |
| Rocky Linux 8 | python-jwcrypto | 0.5.0-2.module+el8.10.0+1818+2dfda7a6 | RLSA-2026:83460 |
| Rocky Linux 8 | python-kdcproxy | 0.4-5.module+el8.9.0+1371+ffa84eb9 | RLSA-2026:83460 |
| Rocky Linux 8 | python-qrcode | 5.3-1.module+el8.10.0+1915+3c70f7d9 | RLSA-2026:83460 |
| Rocky Linux 8 | python-yubico | 1.3.2-9.1.module+el8.9.0+1371+ffa84eb9 | RLSA-2026:83460 |
| Rocky Linux 8 | pyusb | 1.0.0-9.1.module+el8.9.0+1371+ffa84eb9 | RLSA-2026:83460 |
| Rocky Linux 8 | slapi-nis | 0.60.0-4.module+el8.9.0+1573+39ab85f4 | RLSA-2026:83460 |
| Rocky Linux 8 | softhsm | 2.6.0-5.module+el8.9.0+1371+ffa84eb9 | RLSA-2026:83460 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | ipa-client +10 | 4.6.8-5.amzn2.17.6 | ALAS2-2026-3916 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | ipa-client +17 | 4.13.4-1.0.1.el10_2 | ELSA-2026-72279 |
| Oracle Linux 9 | ipa-client +17 | 4.13.4-1.0.1.el9_8 | ELSA-2026-70564 |
| Oracle Linux 8 | bind-dyndb-ldap | 11.6-6.module+el8.10.0+90553+1bd85afa | ELSA-2026-83460 |
| Oracle Linux 8 | custodia +1 | 0.6.0-3.module+el8.9.0+90094+20819f5a | ELSA-2026-83460 |
| Oracle Linux 8 | ipa-client +14 | 4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3 | ELSA-2026-83460 |
| Oracle Linux 8 | ipa-healthcheck +1 | 0.12-6.module+el8.10.0+91065+f06407c0 | ELSA-2026-83460 |
| Oracle Linux 8 | opendnssec | 2.1.7-2.module+el8.10.0+90553+1bd85afa | ELSA-2026-83460 |
| Oracle Linux 8 | python3-jwcrypto | 0.5.0-2.module+el8.10.0+90573+7d6bd8da | ELSA-2026-83460 |
| Oracle Linux 8 | python3-kdcproxy | 0.4-5.module+el8.10.0+90703+a2faa53f.2 | ELSA-2026-83460 |
| Oracle Linux 8 | python3-pyusb | 1.0.0-9.1.module+el8.9.0+90094+20819f5a | ELSA-2026-83460 |
| Oracle Linux 8 | python3-qrcode +1 | 5.3-1.module+el8.10.0+91065+f06407c0 | ELSA-2026-83460 |
| Oracle Linux 8 | python3-yubico | 1.3.2-9.1.module+el8.9.0+90094+20819f5a | ELSA-2026-83460 |
| Oracle Linux 8 | slapi-nis | 0.60.0-4.module+el8.10.0+90297+bfe93ccc | ELSA-2026-83460 |
| Oracle Linux 8 | softhsm +1 | 2.6.0-5.module+el8.9.0+90094+20819f5a | ELSA-2026-83460 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
BrainBob/CVE-2026-76578 ★ 0 · Sep 9, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 19
- WID-SEC-2026-3552 Red Hat Enterprise Linux (FreeIPA): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 1, 2026
- ALSA-2026:72279 Critical: ipa security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:70564 Critical: ipa security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:83460 Critical: idm:DL1 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:83460 Red Hat Security Advisory: idm:DL1 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:83461 Red Hat Security Advisory: idm:DL1 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:83084 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:83085 Red Hat Security Advisory: ipa security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:83083 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:82935 Red Hat Security Advisory: ipa security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72279 Red Hat Security Advisory: ipa security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:70564 Red Hat Security Advisory: ipa security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RLSA-2026:83460 Critical: idm:DL1 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 15, 2026
- ELSA-2026-83460 Critical: idm:DL1 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 15, 2026
- RLSA-2026:72279 Critical: ipa security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 29, 2026
- ELSA-2026-72279 Critical: ipa security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Sep 28, 2026
- RLSA-2026:70564 Critical: ipa security, bug fix, and enhancement update Rocky Linux Security Advisories · Sep 24, 2026
- ELSA-2026-70564 Critical: ipa security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 24, 2026
- ALAS2-2026-3916 Critical: ipa security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 8, 2026
References
- RHSA-2026:70564 vendor-advisory
- RHSA-2026:72279 vendor-advisory
- RHSA-2026:82935 vendor-advisory
- RHSA-2026:83083 vendor-advisory
- RHSA-2026:83084 vendor-advisory
- RHSA-2026:83085 vendor-advisory
- RHSA-2026:83460 vendor-advisory
- RHSA-2026:83461 vendor-advisory
- RHSA-2026:89836 vendor-advisory
- RHSA-2026:93071 vendor-advisory
- RHSA-2026:93452 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-76578 vdb-entry
- RHBZ#2519522 issue-tracking