Skip to content
Heist/ feed
Back to feed
High

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

Type: advisorySources: Official CVE List

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

Products
Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-19550
Confirmed fixed CVEs
Not specified
Updated in this feed
30 Oct 2026, 08:57 UTC · Revision 2

Source evidence

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

core-cve · Original source

Published 11 Aug 2026, 20:46 UTC

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

cve:CVE-2026-19550

Red Hat Enterprise Linux 10

Fixed versions: Not specified

Red Hat Enterprise Linux 10.0 Extended Update Support

Fixed versions: Not specified

Red Hat Enterprise Linux 8

Fixed versions: Not specified

Red Hat Enterprise Linux 8

Fixed versions: Not specified

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

Fixed versions: Not specified

Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

Fixed versions: Not specified

Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Fixed versions: Not specified

Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Fixed versions: Not specified

Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Fixed versions: Not specified

Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Fixed versions: Not specified

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

Fixed versions: Not specified

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

Fixed versions: Not specified

Red Hat Enterprise Linux 9

Fixed versions: Not specified

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Fixed versions: Not specified

Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Fixed versions: Not specified

Red Hat Enterprise Linux 9.6 Extended Update Support

Fixed versions: Not specified

Red Hat Enterprise Linux 6

Fixed versions: Not specified

Red Hat Enterprise Linux 7

Fixed versions: Not specified

Complete source record
{
  "id": "ff2f327e99bcab7d936aa7a6d1f78344725bb65dd571669798ff36eb220a11ed",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-19550",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes",
    "summary": "A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.",
    "evidence": "cve:CVE-2026-19550",
    "products": [
      {
        "name": {
          "value": "Red Hat Enterprise Linux 10",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "evidence": "/containers/cna/affected/1/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 8",
          "evidence": "/containers/cna/affected/2/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 8",
          "evidence": "/containers/cna/affected/3/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "evidence": "/containers/cna/affected/4/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "evidence": "/containers/cna/affected/5/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
          "evidence": "/containers/cna/affected/6/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
          "evidence": "/containers/cna/affected/7/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "evidence": "/containers/cna/affected/8/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "evidence": "/containers/cna/affected/9/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "evidence": "/containers/cna/affected/10/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "evidence": "/containers/cna/affected/11/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 9",
          "evidence": "/containers/cna/affected/12/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "evidence": "/containers/cna/affected/13/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
          "evidence": "/containers/cna/affected/14/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "evidence": "/containers/cna/affected/15/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 6",
          "evidence": "/containers/cna/affected/16/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Red Hat Enterprise Linux 7",
          "evidence": "/containers/cna/affected/17/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-19550",
      "aliases": [
        "CVE-2026-19550"
      ],
      "metrics": [
        {
          "other": {
            "type": "Red Hat severity rating",
            "content": {
              "value": "Important",
              "namespace": "https://access.redhat.com/security/updates/classification/"
            }
          }
        },
        {
          "format": "CVSS",
          "cvssV3_1": {
            "scope": "CHANGED",
            "version": "3.1",
            "baseScore": 8.2,
            "attackVector": "NETWORK",
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "integrityImpact": "HIGH",
            "userInteraction": "NONE",
            "attackComplexity": "HIGH",
            "availabilityImpact": "NONE",
            "privilegesRequired": "LOW",
            "confidentialityImpact": "HIGH"
          }
        }
      ],
      "affected": [
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.13.4-1.el10_2",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "ipa",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux_eus:10.0"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.12.2-15.el10_0.7",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "ipa",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "8100020261007071200.143e9e98",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "idm:client",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "versions": [
            {
              "status": "unaffected",
              "version": "8100020261007070536.823393f5",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "idm:DL1",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "8060020261008134123.c1533a64",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "idm:client",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "8060020261008133528.ada582f1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "idm:DL1",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
          "versions": [
            {
              "status": "unaffected",
              "version": "8060020261008134123.c1533a64",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "idm:client",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.6::appstream",
            "cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
          "versions": [
            {
              "status": "unaffected",
              "version": "8060020261008133528.ada582f1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "idm:DL1",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "versions": [
            {
              "status": "unaffected",
              "version": "8080020261007080925.e581a9e4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "idm:client",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
          "versions": [
            {
              "status": "unaffected",
              "version": "8080020261007071832.b0a6ceea",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "idm:DL1",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "8080020261007080925.e581a9e4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "idm:client",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.8::appstream",
            "cpe:/a:redhat:rhel_tus:8.8::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "8080020261007071832.b0a6ceea",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "idm:DL1",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.13.4-1.el9_8",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "ipa",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.10.1-12.el9_2.7",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "ipa",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.4::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.11.0-15.el9_4.9",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "ipa",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream",
            "cpe:/a:redhat:rhel_eus:9.6::crb"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:4.12.2-14.el9_6.8",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "ipa",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 6",
          "packageName": "ipa",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "packageName": "ipa",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        }
      ],
      "modified": "2026-10-26T13:26:53.495Z",
      "provider": "cve",
      "references": [
        "https://access.redhat.com/errata/RHSA-2026:70564",
        "https://access.redhat.com/errata/RHSA-2026:72279",
        "https://access.redhat.com/errata/RHSA-2026:82935",
        "https://access.redhat.com/errata/RHSA-2026:83083",
        "https://access.redhat.com/errata/RHSA-2026:83084",
        "https://access.redhat.com/errata/RHSA-2026:83085",
        "https://access.redhat.com/errata/RHSA-2026:83460",
        "https://access.redhat.com/errata/RHSA-2026:83461",
        "https://access.redhat.com/errata/RHSA-2026:89836",
        "https://access.redhat.com/security/cve/CVE-2026-19550",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2514019"
      ],
      "provider_metadata": {
        "adp": [
          {
            "title": "CISA ADP Vulnrichment",
            "metrics": [
              {
                "other": {
                  "type": "ssvc",
                  "content": {
                    "id": "CVE-2026-19550",
                    "role": "CISA Coordinator",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "version": "2.0.3",
                    "timestamp": "2026-08-12T12:58:40.442012Z"
                  }
                }
              }
            ],
            "providerMetadata": {
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP",
              "dateUpdated": "2026-08-12T12:58:47.857Z"
            }
          }
        ],
        "cna": {
          "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
          "shortName": "redhat",
          "dateUpdated": "2026-10-26T13:26:53.495Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-19550",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/containers/cna/metrics"
  },
  "source_id": "core-cve",
  "document_id": 307217,
  "published_at": "2026-08-11T20:46:42.019+00:00"
}