Vulnerability · Published Sep 7, 2026 · Assigned by redhat

CVE-2026-76578Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

Critical 9.8

In plain English

A critical-severity missing authentication in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.3%top 29.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	bind-dyndb-ldap	11.6-6.module_el8.10.0+3980+d78e8e90	ALSA-2026:83460
AlmaLinux:8	custodia	0.6.0-3.module_el8.6.0+2881+2f24dc92	ALSA-2026:83460
AlmaLinux:10	ipa-client	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	ipa-client	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	ipa-client	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	ipa-client-common	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	ipa-client-common	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	ipa-client-common	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	ipa-client-encrypted-dns	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:9	ipa-client-encrypted-dns	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	ipa-client-epn	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	ipa-client-epn	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	ipa-client-epn	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	ipa-client-samba	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	ipa-client-samba	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	ipa-client-samba	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	ipa-common	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	ipa-common	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	ipa-common	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:8	ipa-healthcheck	0.12-6.module_el8.10.0+4036+84b152d9	ALSA-2026:83460
AlmaLinux:8	ipa-healthcheck-core	0.12-6.module_el8.10.0+4036+84b152d9	ALSA-2026:83460
AlmaLinux:8	ipa-python-compat	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:10	ipa-selinux	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	ipa-selinux	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	ipa-selinux	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	ipa-selinux-luna	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:9	ipa-selinux-luna	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	ipa-selinux-nfast	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:9	ipa-selinux-nfast	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	ipa-server	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	ipa-server	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	ipa-server	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	ipa-server-common	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	ipa-server-common	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	ipa-server-common	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	ipa-server-dns	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	ipa-server-dns	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	ipa-server-dns	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	ipa-server-encrypted-dns	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:9	ipa-server-encrypted-dns	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	ipa-server-trust-ad	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	ipa-server-trust-ad	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	ipa-server-trust-ad	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:8	opendnssec	2.1.7-2.module_el8.10.0+3980+d78e8e90	ALSA-2026:83460
AlmaLinux:8	python3-custodia	0.6.0-3.module_el8.6.0+2881+2f24dc92	ALSA-2026:83460
AlmaLinux:10	python3-ipaclient	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	python3-ipaclient	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	python3-ipaclient	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	python3-ipalib	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	python3-ipalib	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	python3-ipalib	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	python3-ipaserver	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	python3-ipaserver	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	python3-ipaserver	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:10	python3-ipatests	4.13.4-1.el10_2	ALSA-2026:72279
AlmaLinux:8	python3-ipatests	4.9.13-21.module_el8.10.0+4302+2d2000af.3	ALSA-2026:83460
AlmaLinux:9	python3-ipatests	4.13.4-1.el9_8	ALSA-2026:70564
AlmaLinux:8	python3-jwcrypto	0.5.0-2.module_el8.10.0+3844+20e075e5	ALSA-2026:83460
AlmaLinux:8	python3-kdcproxy	0.4-5.module_el8.10.0+4069+1d9eaa78.2	ALSA-2026:83460
AlmaLinux:8	python3-pyusb	1.0.0-9.1.module_el8.7.0+3349+cfeff52e	ALSA-2026:83460
AlmaLinux:8	python3-qrcode	5.3-1.module_el8.10.0+3942+63b39a46	ALSA-2026:83460
AlmaLinux:8	python3-qrcode-core	5.3-1.module_el8.10.0+3942+63b39a46	ALSA-2026:83460
AlmaLinux:8	python3-yubico	1.3.2-9.1.module_el8.7.0+3349+cfeff52e	ALSA-2026:83460
AlmaLinux:8	slapi-nis	0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1	ALSA-2026:83460
AlmaLinux:8	softhsm	2.6.0-5.module_el8.6.0+3031+2f24dc92	ALSA-2026:83460
AlmaLinux:8	softhsm	2.6.0-5.module_el8.6.0+2881+2f24dc92	ALSA-2026:83460
AlmaLinux:8	softhsm-devel	2.6.0-5.module_el8.6.0+3031+2f24dc92	ALSA-2026:83460
AlmaLinux:8	softhsm-devel	2.6.0-5.module_el8.6.0+2881+2f24dc92	ALSA-2026:83460
Debian:12	freeipa	no fix listed	DEBIAN-CVE-2026-76578
Debian:13	freeipa	no fix listed	DEBIAN-CVE-2026-76578
Rocky Linux:8	bind-dyndb-ldap	0:11.6-6.module+el8.10.0+1960+1ed527b3	RLSA-2026:83460
Rocky Linux:8	custodia	0:0.6.0-3.module+el8.9.0+1371+ffa84eb9	RLSA-2026:83460
Rocky Linux:10	ipa	0:4.13.4-1.el10_2	RLSA-2026:72279
Rocky Linux:8	ipa	0:4.9.13-21.module+el8.10.0+40090+e6f37a74	RLSA-2026:83460
Rocky Linux:8	ipa	0:4.9.13-21.module+el8.10.0+40089+03bf3c1f	RLSA-2026:83460
Rocky Linux:9	ipa	0:4.13.4-1.el9_8	RLSA-2026:70564
Rocky Linux:8	ipa-healthcheck	0:0.12-6.module+el8.10.0+2054+aa003774	RLSA-2026:83460
Rocky Linux:8	ipa-healthcheck	0:0.12-6.module+el8.10.0+2053+a0a9dc19	RLSA-2026:83460
Rocky Linux:8	opendnssec	0:2.1.7-2.module+el8.10.0+1960+1ed527b3	RLSA-2026:83460
Rocky Linux:8	python-jwcrypto	0:0.5.0-2.module+el8.10.0+1819+0aeba2f1	RLSA-2026:83460
Rocky Linux:8	python-jwcrypto	0:0.5.0-2.module+el8.10.0+1818+2dfda7a6	RLSA-2026:83460
Rocky Linux:8	python-kdcproxy	0:0.4-5.module+el8.10.0+2094+d7886766.2	RLSA-2026:83460
Rocky Linux:8	python-kdcproxy	0:0.4-5.module+el8.9.0+1371+ffa84eb9	RLSA-2026:83460
Rocky Linux:8	python-kdcproxy	0:0.4-5.module+el8.10.0+1915+3c70f7d9.1	RLSA-2026:83460
Rocky Linux:8	python-qrcode	0:5.3-1.module+el8.10.0+1916+6bb8cf6b	RLSA-2026:83460
Rocky Linux:8	python-qrcode	0:5.3-1.module+el8.10.0+1915+3c70f7d9	RLSA-2026:83460
Rocky Linux:8	python-yubico	0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9	RLSA-2026:83460
Rocky Linux:8	python-yubico	0:1.3.2-9.1.module+el8.9.0+1372+09f67869	RLSA-2026:83460
Rocky Linux:8	pyusb	0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9	RLSA-2026:83460
Rocky Linux:8	pyusb	0:1.0.0-9.1.module+el8.9.0+1372+09f67869	RLSA-2026:83460
Rocky Linux:8	slapi-nis	0:0.60.0-4.module+el8.9.0+1573+39ab85f4	RLSA-2026:83460
Rocky Linux:8	softhsm	0:2.6.0-5.module+el8.9.0+1371+ffa84eb9	RLSA-2026:83460
Ubuntu:22.04:LTS	freeipa	no fix listed	UBUNTU-CVE-2026-76578
Ubuntu:24.04:LTS	freeipa	no fix listed	UBUNTU-CVE-2026-76578
Ubuntu:26.04:LTS	freeipa	no fix listed	UBUNTU-CVE-2026-76578
Ubuntu:26.10	freeipa	no fix listed	UBUNTU-CVE-2026-76578

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 6	see references

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

RHSA-2026:70564 vendor-advisory, x_refsource_REDHAT
RHSA-2026:72279 vendor-advisory, x_refsource_REDHAT
RHSA-2026:82935 vendor-advisory, x_refsource_REDHAT
RHSA-2026:83083 vendor-advisory, x_refsource_REDHAT
RHSA-2026:83084 vendor-advisory, x_refsource_REDHAT
RHSA-2026:83085 vendor-advisory, x_refsource_REDHAT
RHSA-2026:83460 vendor-advisory, x_refsource_REDHAT
RHSA-2026:83461 vendor-advisory, x_refsource_REDHAT
RHSA-2026:89836 vendor-advisory, x_refsource_REDHAT
RHSA-2026:93071 vendor-advisory, x_refsource_REDHAT
RHSA-2026:93452 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-76578 vdb-entry, x_refsource_REDHAT
RHBZ#2519522 issue-tracking, x_refsource_REDHAT