Critical
Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci
Type: advisorySources: Official CVE List
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
- Products
- Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-76578
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 08:57 UTC · Revision 2
Source evidence
Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci
core-cve · Original sourcePublished 7 Sept 2026, 12:01 UTC
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
cve:CVE-2026-76578
Red Hat Enterprise Linux 10
Fixed versions: Not specified
Red Hat Enterprise Linux 10.0 Extended Update Support
Fixed versions: Not specified
Red Hat Enterprise Linux 8
Fixed versions: Not specified
Red Hat Enterprise Linux 8
Fixed versions: Not specified
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Fixed versions: Not specified
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Fixed versions: Not specified
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Fixed versions: Not specified
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Fixed versions: Not specified
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Fixed versions: Not specified
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Fixed versions: Not specified
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Fixed versions: Not specified
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Fixed versions: Not specified
Red Hat Enterprise Linux 9
Fixed versions: Not specified
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Fixed versions: Not specified
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Fixed versions: Not specified
Red Hat Enterprise Linux 9.6 Extended Update Support
Fixed versions: Not specified
Red Hat Enterprise Linux 6
Fixed versions: Not specified
Red Hat Enterprise Linux 7
Fixed versions: Not specified
Red Hat Enterprise Linux 8
Fixed versions: Not specified
Complete source record
{
"id": "6c4d7c9e497c8cc0d8f4f3079d773ba85be57d9e30e129dfefd49c499dd5b151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76578",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci",
"summary": "A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.",
"evidence": "cve:CVE-2026-76578",
"products": [
{
"name": {
"value": "Red Hat Enterprise Linux 10",
"evidence": "/containers/cna/affected/0/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"evidence": "/containers/cna/affected/1/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8",
"evidence": "/containers/cna/affected/2/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8",
"evidence": "/containers/cna/affected/3/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"evidence": "/containers/cna/affected/4/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"evidence": "/containers/cna/affected/5/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"evidence": "/containers/cna/affected/6/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"evidence": "/containers/cna/affected/7/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"evidence": "/containers/cna/affected/8/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"evidence": "/containers/cna/affected/9/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"evidence": "/containers/cna/affected/10/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"evidence": "/containers/cna/affected/11/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 9",
"evidence": "/containers/cna/affected/12/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"evidence": "/containers/cna/affected/13/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"evidence": "/containers/cna/affected/14/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"evidence": "/containers/cna/affected/15/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 6",
"evidence": "/containers/cna/affected/16/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 7",
"evidence": "/containers/cna/affected/17/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8",
"evidence": "/containers/cna/affected/18/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "CVE-2026-76578",
"aliases": [
"CVE-2026-76578"
],
"metrics": [
{
"other": {
"type": "Red Hat severity rating",
"content": {
"value": "Critical",
"namespace": "https://access.redhat.com/security/updates/classification/"
}
}
},
{
"format": "CVSS",
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
}
],
"affected": [
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"versions": [
{
"status": "unaffected",
"version": "0:4.13.4-1.el10_2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:4.12.2-15.el10_0.7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "8100020261007071200.143e9e98",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "8100020261007070536.823393f5",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:DL1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "8060020261008134123.c1533a64",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "8060020261008133528.ada582f1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:DL1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"versions": [
{
"status": "unaffected",
"version": "8060020261008134123.c1533a64",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"versions": [
{
"status": "unaffected",
"version": "8060020261008133528.ada582f1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:DL1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "8080020261007080925.e581a9e4",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "8080020261007071832.b0a6ceea",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:DL1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "8080020261007080925.e581a9e4",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "8080020261007071832.b0a6ceea",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:DL1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:4.13.4-1.el9_8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:4.10.1-12.el9_2.7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:4.11.0-15.el9_4.9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream",
"cpe:/a:redhat:rhel_eus:9.6::crb"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:4.12.2-14.el9_6.8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
}
],
"modified": "2026-10-26T13:27:03.881Z",
"provider": "cve",
"references": [
"https://access.redhat.com/errata/RHSA-2026:70564",
"https://access.redhat.com/errata/RHSA-2026:72279",
"https://access.redhat.com/errata/RHSA-2026:82935",
"https://access.redhat.com/errata/RHSA-2026:83083",
"https://access.redhat.com/errata/RHSA-2026:83084",
"https://access.redhat.com/errata/RHSA-2026:83085",
"https://access.redhat.com/errata/RHSA-2026:83460",
"https://access.redhat.com/errata/RHSA-2026:83461",
"https://access.redhat.com/errata/RHSA-2026:89836",
"https://access.redhat.com/security/cve/CVE-2026-76578",
"https://bugzilla.redhat.com/show_bug.cgi?id=2519522"
],
"provider_metadata": {
"adp": [
{
"title": "CISA ADP Vulnrichment",
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"id": "CVE-2026-76578",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-09-08T13:58:12.782701Z"
}
}
}
],
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-09-08T13:59:38.057Z"
}
}
],
"cna": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-10-26T13:27:03.881Z"
}
}
},
"related_cves": [
{
"value": "CVE-2026-76578",
"evidence": "/cveMetadata/cveId"
}
],
"security_relevant": true,
"severity_evidence": "/containers/cna/metrics"
},
"source_id": "core-cve",
"document_id": 307219,
"published_at": "2026-09-07T12:01:36.194+00:00"
}