UnratedFix available

Critical: ipa security, bug fix, and enhancement update

Type: advisorySource: OSV1 source record

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux9.8] (JIRA:AlmaLinux-170987) * WebUI Hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238511) * ipa-otptoken-import hardening [almalinux-9

Announced 23 Sept 2026Source revision 1

Original source ↗

ALSA-2026:70564

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:ALSA-2026:70564

ipa-client

Source reference: /affected/0/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

ipa-client-common

Source reference: /affected/1/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

ipa-client-encrypted-dns

Source reference: /affected/2/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

ipa-client-epn

Source reference: /affected/3/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

ipa-client-samba

Source reference: /affected/4/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

ipa-common

Source reference: /affected/5/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/5/ranges
Prerequisites: Not stated in this record

ipa-selinux

Source reference: /affected/6/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/6/ranges
Prerequisites: Not stated in this record

ipa-selinux-luna

Source reference: /affected/7/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/7/ranges
Prerequisites: Not stated in this record

ipa-selinux-nfast

Source reference: /affected/8/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/8/ranges
Prerequisites: Not stated in this record

ipa-server

Source reference: /affected/9/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/9/ranges
Prerequisites: Not stated in this record

ipa-server-common

Source reference: /affected/10/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/10/ranges
Prerequisites: Not stated in this record

ipa-server-dns

Source reference: /affected/11/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/11/ranges
Prerequisites: Not stated in this record

ipa-server-encrypted-dns

Source reference: /affected/12/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/12/ranges
Prerequisites: Not stated in this record

ipa-server-trust-ad

Source reference: /affected/13/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/13/ranges
Prerequisites: Not stated in this record

python3-ipaclient

Source reference: /affected/14/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/14/ranges
Prerequisites: Not stated in this record

python3-ipalib

Source reference: /affected/15/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/15/ranges
Prerequisites: Not stated in this record

python3-ipaserver

Source reference: /affected/16/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/16/ranges
Prerequisites: Not stated in this record

python3-ipatests

Source reference: /affected/17/package/name

Affected versions: Not stated in this record
Fixed versions: 4.13.4-1.el9_8
Source reference: /affected/17/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-client",
      "purl": "pkg:rpm/almalinux/ipa-client",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-client-common",
      "purl": "pkg:rpm/almalinux/ipa-client-common",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-client-encrypted-dns",
      "purl": "pkg:rpm/almalinux/ipa-client-encrypted-dns",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-client-epn",
      "purl": "pkg:rpm/almalinux/ipa-client-epn",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-client-samba",
      "purl": "pkg:rpm/almalinux/ipa-client-samba",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-common",
      "purl": "pkg:rpm/almalinux/ipa-common",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-selinux",
      "purl": "pkg:rpm/almalinux/ipa-selinux",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-selinux-luna",
      "purl": "pkg:rpm/almalinux/ipa-selinux-luna",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-selinux-nfast",
      "purl": "pkg:rpm/almalinux/ipa-selinux-nfast",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-server",
      "purl": "pkg:rpm/almalinux/ipa-server",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-server-common",
      "purl": "pkg:rpm/almalinux/ipa-server-common",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-server-dns",
      "purl": "pkg:rpm/almalinux/ipa-server-dns",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-server-encrypted-dns",
      "purl": "pkg:rpm/almalinux/ipa-server-encrypted-dns",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "ipa-server-trust-ad",
      "purl": "pkg:rpm/almalinux/ipa-server-trust-ad",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "python3-ipaclient",
      "purl": "pkg:rpm/almalinux/python3-ipaclient",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "python3-ipalib",
      "purl": "pkg:rpm/almalinux/python3-ipalib",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "python3-ipaserver",
      "purl": "pkg:rpm/almalinux/python3-ipaserver",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "4.13.4-1.el9_8"
          }
        ]
      }
    ],
    "package": {
      "name": "python3-ipatests",
      "purl": "pkg:rpm/almalinux/python3-ipatests",
      "ecosystem": "AlmaLinux:9"
    },
    "database_specific": {
      "source": "https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2026:70564.json"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #18968 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 02:01:23 GMT
Publisher date: Wed, 23 Sep 2026 00:00:00 GMT

Read the original announcement