Skip to content
OpenAdvisories

Description

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support — —
Red Hat Red Hat Enterprise Linux 8 — —
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support — —
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On — —
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support — —
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On — —
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service — —
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions — —
Red Hat Red Hat Enterprise Linux 9 — —
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions — —
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions — —
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support — —
Red Hat Red Hat Enterprise Linux 6 — —
Red Hat Red Hat Enterprise Linux 7 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 freeipa No fix yet —
Debian 13 freeipa No fix yet —
Debian 12 freeipa No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 freeipa No fix yet —
Ubuntu 26.04 LTS freeipa No fix yet —
Ubuntu 24.04 LTS freeipa No fix yet —
Ubuntu 22.04 LTS freeipa No fix yet —
Ubuntu 20.04 LTS freeipa No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS freeipa No fix yet —
Ubuntu Pro 16.04 LTS freeipa No fix yet —
Ubuntu Pro 14.04 LTS freeipa No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 ipa +18 4.13.4-1.el10_2 RHSA-2026:72279
RHEL 9 ipa +18 4.13.4-1.el9_8 RHSA-2026:70564
RHEL 8 bind-dyndb-ldap 11.6-6.module+el8.10.0+23009+91fb337e RHSA-2026:83460
RHEL 8 custodia +1 0.6.0-3.module+el8.9.0+18911+94941f82 RHSA-2026:83460
RHEL 8 ipa +9 4.9.13-21.module+el8.10.0+25042+a3bddcd5.3 RHSA-2026:83460
RHEL 8 ipa-healthcheck +1 0.12-6.module+el8.10.0+23404+f6b3454f RHSA-2026:83460
RHEL 8 ipa-server +5 4.9.13-21.module+el8.10.0+25041+701625f4.3 RHSA-2026:83460
RHEL 8 opendnssec 2.1.7-2.module+el8.10.0+22913+7aa1a207 RHSA-2026:83460
RHEL 8 python-jwcrypto +1 0.5.0-2.module+el8.10.0+21692+c9b201bc RHSA-2026:83460
RHEL 8 python-kdcproxy +1 0.4-5.module+el8.10.0+23610+7d6e87e5.2 RHSA-2026:83460
RHEL 8 python-qrcode +2 5.3-1.module+el8.10.0+22544+6a7f07c2 RHSA-2026:83460
RHEL 8 python-yubico +1 1.3.2-9.1.module+el8.9.0+18920+2223d05e RHSA-2026:83460
RHEL 8 pyusb +1 1.0.0-9.1.module+el8.9.0+18920+2223d05e RHSA-2026:83460
RHEL 8 slapi-nis 0.60.0-4.module+el8.10.0+20723+03062ebd RHSA-2026:83460
RHEL 8 softhsm +1 2.6.0-5.module+el8.9.0+18911+94941f82 RHSA-2026:83460
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS ipa +18 4.12.2-15.el10_0.7 RHSA-2026:82935
RHEL 9.6 EUS ipa +18 4.12.2-14.el9_6.8 RHSA-2026:83083
RHEL 9.4 E4S ipa +13 4.11.0-15.el9_4.9 RHSA-2026:83084
RHEL 9.2 E4S ipa +13 4.10.1-12.el9_2.7 RHSA-2026:83085
RHEL 8.8 TUS bind-dyndb-ldap 11.6-4.module+el8.8.0+21675+157fa23b.2 RHSA-2026:83461
RHEL 8.8 TUS custodia +1 0.6.0-3.module+el8.1.0+4098+f286395e RHSA-2026:83461
RHEL 8.8 TUS ipa +9 4.9.11-11.module+el8.8.0+25045+e21657cc.6 RHSA-2026:83461
RHEL 8.8 TUS ipa-healthcheck +1 0.12-1.module+el8.8.0+17583+8c783c60 RHSA-2026:83461
RHEL 8.8 TUS ipa-server +5 4.9.11-11.module+el8.8.0+25043+cab6964c.6 RHSA-2026:83461
RHEL 8.8 TUS opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8 RHSA-2026:83461
RHEL 8.8 TUS python-jwcrypto +1 0.5.0-1.1.module+el8.7.0+15888+685a878f RHSA-2026:83461
RHEL 8.8 TUS python-kdcproxy +1 0.4-5.module+el8.8.0+24989+289c67e6.1 RHSA-2026:83461
RHEL 8.8 TUS python-qrcode +2 5.1-12.module+el8.1.0+4107+4a66eb87 RHSA-2026:83461
RHEL 8.8 TUS python-yubico +1 1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 RHSA-2026:83461
RHEL 8.8 TUS pyusb +1 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 RHSA-2026:83461
RHEL 8.8 TUS slapi-nis 0.60.0-4.module+el8.8.0+20635+330e3683 RHSA-2026:83461
RHEL 8.8 TUS softhsm +1 2.6.0-5.module+el8.4.0+10227+076cd560 RHSA-2026:83461
RHEL 8.8 E4S bind-dyndb-ldap 11.6-4.module+el8.8.0+21675+157fa23b.2 RHSA-2026:83461
RHEL 8.8 E4S custodia +1 0.6.0-3.module+el8.1.0+4098+f286395e RHSA-2026:83461
RHEL 8.8 E4S ipa +9 4.9.11-11.module+el8.8.0+25045+e21657cc.6 RHSA-2026:83461
RHEL 8.8 E4S ipa-healthcheck +1 0.12-1.module+el8.8.0+17583+8c783c60 RHSA-2026:83461
RHEL 8.8 E4S ipa-server +5 4.9.11-11.module+el8.8.0+25043+cab6964c.6 RHSA-2026:83461
RHEL 8.8 E4S opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8 RHSA-2026:83461
RHEL 8.8 E4S python-jwcrypto +1 0.5.0-1.1.module+el8.7.0+15888+685a878f RHSA-2026:83461
RHEL 8.8 E4S python-kdcproxy +1 0.4-5.module+el8.8.0+24989+289c67e6.1 RHSA-2026:83461
RHEL 8.8 E4S python-qrcode +2 5.1-12.module+el8.1.0+4107+4a66eb87 RHSA-2026:83461
RHEL 8.8 E4S python-yubico +1 1.3.2-9.1.module+el8.7.0+15691+2b2c1dd5 RHSA-2026:83461
RHEL 8.8 E4S pyusb +1 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5 RHSA-2026:83461
RHEL 8.8 E4S slapi-nis 0.60.0-4.module+el8.8.0+20635+330e3683 RHSA-2026:83461
RHEL 8.8 E4S softhsm +1 2.6.0-5.module+el8.4.0+10227+076cd560 RHSA-2026:83461
RHEL 8.6 EUS Long Life bind-dyndb-ldap 11.6-4.module+el8.6.0+21751+4d78cb83.3 RHSA-2026:89836
RHEL 8.6 EUS Long Life custodia +1 0.6.0-3.module+el8.1.0+4098+f286395e RHSA-2026:89836
RHEL 8.6 EUS Long Life ipa +9 4.9.8-13.module+el8.6.0+25054+4a5dd89b.4 RHSA-2026:89836
RHEL 8.6 EUS Long Life ipa-healthcheck +1 0.7-10.module+el8.6.0+14300+0c339766 RHSA-2026:89836
RHEL 8.6 EUS Long Life ipa-server +5 4.9.8-13.module+el8.6.0+25053+bc39327b.4 RHSA-2026:89836
RHEL 8.6 EUS Long Life opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8 RHSA-2026:89836
RHEL 8.6 EUS Long Life python-jwcrypto +1 0.5.0-1.module+el8.1.0+4107+4a66eb87 RHSA-2026:89836
RHEL 8.6 EUS Long Life python-kdcproxy +1 0.4-5.module+el8.6.0+25053+bc39327b.1 RHSA-2026:89836
RHEL 8.6 EUS Long Life python-qrcode +2 5.1-12.module+el8.1.0+4107+4a66eb87 RHSA-2026:89836
RHEL 8.6 EUS Long Life python-yubico +1 1.3.2-9.module+el8.1.0+4107+4a66eb87 RHSA-2026:89836
RHEL 8.6 EUS Long Life pyusb +1 1.0.0-9.module+el8.1.0+4107+4a66eb87 RHSA-2026:89836
RHEL 8.6 EUS Long Life slapi-nis 0.60.0-1.module+el8.6.0+16878+6c033536 RHSA-2026:89836
RHEL 8.6 EUS Long Life softhsm +1 2.6.0-5.module+el8.4.0+10227+076cd560 RHSA-2026:89836
RHEL 8.6 AUS bind-dyndb-ldap 11.6-4.module+el8.6.0+21751+4d78cb83.3 RHSA-2026:89836
RHEL 8.6 AUS custodia +1 0.6.0-3.module+el8.1.0+4098+f286395e RHSA-2026:89836
RHEL 8.6 AUS ipa +9 4.9.8-13.module+el8.6.0+25054+4a5dd89b.4 RHSA-2026:89836
RHEL 8.6 AUS ipa-healthcheck +1 0.7-10.module+el8.6.0+14300+0c339766 RHSA-2026:89836
RHEL 8.6 AUS ipa-server +5 4.9.8-13.module+el8.6.0+25053+bc39327b.4 RHSA-2026:89836
RHEL 8.6 AUS opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8 RHSA-2026:89836
RHEL 8.6 AUS python-jwcrypto +1 0.5.0-1.module+el8.1.0+4107+4a66eb87 RHSA-2026:89836
RHEL 8.6 AUS python-kdcproxy +1 0.4-5.module+el8.6.0+25053+bc39327b.1 RHSA-2026:89836
RHEL 8.6 AUS python-qrcode +2 5.1-12.module+el8.1.0+4107+4a66eb87 RHSA-2026:89836
RHEL 8.6 AUS python-yubico +1 1.3.2-9.module+el8.1.0+4107+4a66eb87 RHSA-2026:89836
RHEL 8.6 AUS pyusb +1 1.0.0-9.module+el8.1.0+4107+4a66eb87 RHSA-2026:89836
RHEL 8.6 AUS slapi-nis 0.60.0-1.module+el8.6.0+16878+6c033536 RHSA-2026:89836
RHEL 8.6 AUS softhsm +1 2.6.0-5.module+el8.4.0+10227+076cd560 RHSA-2026:89836
RHEL 8.4 EUS Long Life bind-dyndb-ldap 11.6-2.module+el8.4.0+21736+855b82c8.1 RHSA-2026:93452
RHEL 8.4 EUS Long Life custodia +1 0.6.0-3.module+el8.1.0+4098+f286395e RHSA-2026:93452
RHEL 8.4 EUS Long Life ipa +9 4.9.2-10.module+el8.4.0+25231+beff12c5.6 RHSA-2026:93452
RHEL 8.4 EUS Long Life ipa-healthcheck +1 0.7-3.module+el8.4.0+9008+94c5103b RHSA-2026:93452
RHEL 8.4 EUS Long Life ipa-server +5 4.9.2-10.module+el8.4.0+25230+139d38e7.6 RHSA-2026:93452
RHEL 8.4 EUS Long Life opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8 RHSA-2026:93452
RHEL 8.4 EUS Long Life python-jwcrypto +1 0.5.0-1.module+el8.1.0+4107+4a66eb87 RHSA-2026:93452
RHEL 8.4 EUS Long Life python-kdcproxy +1 0.4-5.module+el8.4.0+25050+823e00a8.1 RHSA-2026:93452
RHEL 8.4 EUS Long Life python-qrcode +2 5.1-12.module+el8.1.0+4107+4a66eb87 RHSA-2026:93452
RHEL 8.4 EUS Long Life python-yubico +1 1.3.2-9.module+el8.1.0+4107+4a66eb87 RHSA-2026:93452
RHEL 8.4 EUS Long Life pyusb +1 1.0.0-9.module+el8.1.0+4107+4a66eb87 RHSA-2026:93452
RHEL 8.4 EUS Long Life slapi-nis 0.56.6-2.1.module+el8.4.0+12579+0538eac8 RHSA-2026:93452
RHEL 8.4 EUS Long Life softhsm +1 2.6.0-5.module+el8.4.0+10227+076cd560 RHSA-2026:93452
RHEL 8.4 AUS bind-dyndb-ldap 11.6-2.module+el8.4.0+21736+855b82c8.1 RHSA-2026:93452
RHEL 8.4 AUS custodia +1 0.6.0-3.module+el8.1.0+4098+f286395e RHSA-2026:93452
RHEL 8.4 AUS ipa +9 4.9.2-10.module+el8.4.0+25231+beff12c5.6 RHSA-2026:93452
RHEL 8.4 AUS ipa-healthcheck +1 0.7-3.module+el8.4.0+9008+94c5103b RHSA-2026:93452
RHEL 8.4 AUS ipa-server +5 4.9.2-10.module+el8.4.0+25230+139d38e7.6 RHSA-2026:93452
RHEL 8.4 AUS opendnssec 2.1.7-1.module+el8.4.0+9007+5084bdd8 RHSA-2026:93452
RHEL 8.4 AUS python-jwcrypto +1 0.5.0-1.module+el8.1.0+4107+4a66eb87 RHSA-2026:93452
RHEL 8.4 AUS python-kdcproxy +1 0.4-5.module+el8.4.0+25050+823e00a8.1 RHSA-2026:93452
RHEL 8.4 AUS python-qrcode +2 5.1-12.module+el8.1.0+4107+4a66eb87 RHSA-2026:93452
RHEL 8.4 AUS python-yubico +1 1.3.2-9.module+el8.1.0+4107+4a66eb87 RHSA-2026:93452
RHEL 8.4 AUS pyusb +1 1.0.0-9.module+el8.1.0+4107+4a66eb87 RHSA-2026:93452
RHEL 8.4 AUS slapi-nis 0.56.6-2.1.module+el8.4.0+12579+0538eac8 RHSA-2026:93452
RHEL 8.4 AUS softhsm +1 2.6.0-5.module+el8.4.0+10227+076cd560 RHSA-2026:93452

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 ipa-client +17 4.13.4-1.el10_2 ALSA-2026:72279
AlmaLinux 9 ipa-client +17 4.13.4-1.el9_8 ALSA-2026:70564
AlmaLinux 8 bind-dyndb-ldap 11.6-6.module_el8.10.0+3980+d78e8e90 ALSA-2026:83460
AlmaLinux 8 custodia +1 0.6.0-3.module_el8.6.0+2881+2f24dc92 ALSA-2026:83460
AlmaLinux 8 ipa-client +14 4.9.13-21.module_el8.10.0+4302+2d2000af.3 ALSA-2026:83460
AlmaLinux 8 ipa-healthcheck +1 0.12-6.module_el8.10.0+4036+84b152d9 ALSA-2026:83460
AlmaLinux 8 opendnssec 2.1.7-2.module_el8.10.0+3980+d78e8e90 ALSA-2026:83460
AlmaLinux 8 python3-jwcrypto 0.5.0-2.module_el8.10.0+3844+20e075e5 ALSA-2026:83460
AlmaLinux 8 python3-kdcproxy 0.4-5.module_el8.10.0+4069+1d9eaa78.2 ALSA-2026:83460
AlmaLinux 8 python3-pyusb 1.0.0-9.1.module_el8.7.0+3349+cfeff52e ALSA-2026:83460
AlmaLinux 8 python3-qrcode +1 5.3-1.module_el8.10.0+3942+63b39a46 ALSA-2026:83460
AlmaLinux 8 python3-yubico 1.3.2-9.1.module_el8.7.0+3349+cfeff52e ALSA-2026:83460
AlmaLinux 8 slapi-nis 0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1 ALSA-2026:83460
AlmaLinux 8 softhsm +1 2.6.0-5.module_el8.6.0+2881+2f24dc92 ALSA-2026:83460

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 ipa 4.13.4-1.el10_2 RLSA-2026:72279
Rocky Linux 9 ipa 4.13.4-1.el9_8 RLSA-2026:70564
Rocky Linux 8 bind-dyndb-ldap 11.6-6.module+el8.10.0+1960+1ed527b3 RLSA-2026:83460
Rocky Linux 8 custodia 0.6.0-3.module+el8.9.0+1371+ffa84eb9 RLSA-2026:83460
Rocky Linux 8 ipa 4.9.13-21.module+el8.10.0+40089+03bf3c1f RLSA-2026:83460
Rocky Linux 8 ipa-healthcheck 0.12-6.module+el8.10.0+2053+a0a9dc19 RLSA-2026:83460
Rocky Linux 8 opendnssec 2.1.7-2.module+el8.10.0+1960+1ed527b3 RLSA-2026:83460
Rocky Linux 8 python-jwcrypto 0.5.0-2.module+el8.10.0+1818+2dfda7a6 RLSA-2026:83460
Rocky Linux 8 python-kdcproxy 0.4-5.module+el8.9.0+1371+ffa84eb9 RLSA-2026:83460
Rocky Linux 8 python-qrcode 5.3-1.module+el8.10.0+1915+3c70f7d9 RLSA-2026:83460
Rocky Linux 8 python-yubico 1.3.2-9.1.module+el8.9.0+1371+ffa84eb9 RLSA-2026:83460
Rocky Linux 8 pyusb 1.0.0-9.1.module+el8.9.0+1371+ffa84eb9 RLSA-2026:83460
Rocky Linux 8 slapi-nis 0.60.0-4.module+el8.9.0+1573+39ab85f4 RLSA-2026:83460
Rocky Linux 8 softhsm 2.6.0-5.module+el8.9.0+1371+ffa84eb9 RLSA-2026:83460

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 ipa-client +17 4.13.4-1.0.1.el10_2 ELSA-2026-72279
Oracle Linux 9 ipa-client +17 4.13.4-1.0.1.el9_8 ELSA-2026-70564
Oracle Linux 8 bind-dyndb-ldap 11.6-6.module+el8.10.0+90553+1bd85afa ELSA-2026-83460
Oracle Linux 8 custodia +1 0.6.0-3.module+el8.9.0+90094+20819f5a ELSA-2026-83460
Oracle Linux 8 ipa-client +14 4.9.13-21.0.2.module+el8.10.0+91065+f06407c0.3 ELSA-2026-83460
Oracle Linux 8 ipa-healthcheck +1 0.12-6.module+el8.10.0+91065+f06407c0 ELSA-2026-83460
Oracle Linux 8 opendnssec 2.1.7-2.module+el8.10.0+90553+1bd85afa ELSA-2026-83460
Oracle Linux 8 python3-jwcrypto 0.5.0-2.module+el8.10.0+90573+7d6bd8da ELSA-2026-83460
Oracle Linux 8 python3-kdcproxy 0.4-5.module+el8.10.0+90703+a2faa53f.2 ELSA-2026-83460
Oracle Linux 8 python3-pyusb 1.0.0-9.1.module+el8.9.0+90094+20819f5a ELSA-2026-83460
Oracle Linux 8 python3-qrcode +1 5.3-1.module+el8.10.0+91065+f06407c0 ELSA-2026-83460
Oracle Linux 8 python3-yubico 1.3.2-9.1.module+el8.9.0+90094+20819f5a ELSA-2026-83460
Oracle Linux 8 slapi-nis 0.60.0-4.module+el8.10.0+90297+bfe93ccc ELSA-2026-83460
Oracle Linux 8 softhsm +1 2.6.0-5.module+el8.9.0+90094+20819f5a ELSA-2026-83460

Advisories 20

References