# FreeIPA anonymous LDAP write plants a Kerberos principal in the admins group

Source: https://startwithidentity.com/cves/cve-2026-76578/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

FreeIPA lets users manage their own OTP tokens, and a default access control instruction (ACI) in `default-aci.ldif` grants that right with the bind rule `userdn = "ldap:///self"`. The FreeIPA 4.13.4 release notes say that an unauthenticated LDAP client, using an anonymous bind or SASL ANONYMOUS, could create a self-managed OTP token entry, and because the ACI did not restrict which other attributes came with it, the client could inject "an arbitrary attacker-chosen Kerberos principal that does not yet exist." The enabling bug sits in 389 Directory Server: an empty DN satisfied the SELFDN ACI evaluator. That flaw is tracked separately. Red Hat's CVE page says the combination lets the attacker get the planted principal added to the administrators group, and that Red Hat confirmed exploitation against a default, unmodified FreeIPA installation. The CWE is CWE-306 (missing authentication for a critical function). NVD has not yet scored it; the CNA (Red Hat) score is CVSS 3.1 9.8. FreeIPA 4.13.4 was tagged on September 7, 2026. It is not on CISA KEV.

## Why it matters

FreeIPA is the identity provider: it is the Kerberos KDC, the LDAP directory and the policy store for every enrolled Linux host. An anonymous network client that can mint a principal and put it in `admins` holds genuine administrator credentials, not a foothold. NVD's description adds that on SID-enabled deployments the attacker can also act against other IdM services, so the blast radius is every [Kerberos](https://startwithidentity.com/glossary/kerberos/) service and [LDAP](https://startwithidentity.com/glossary/ldap/) consumer that trusts the realm. Red Hat notes that an earlier fix, CVE-2026-13097, blocked taking over the literal `admin` name, but the unauthenticated write stayed open.

## What to do

- Upgrade to FreeIPA 4.13.4 or the Red Hat errata for your release. The new bind rule is `(userdn = "ldap:///self" and userdn = "ldap:///all")`, which an empty anonymous DN cannot match, and the upgrade runs new `21-*` ACI scripts that deny anonymous modifications.
- Update 389 Directory Server in the same change window.
- Until then, restrict ports 389 and 636 to trusted hosts. Red Hat says disabling anonymous binds blocks the path, but test first that nothing depends on them.

## After you patch

- List members of `admins` and every principal created since your last known-good audit; remove any you cannot account for.
- Review OTP token entries whose owner is unexpected, and rotate the keytabs and passwords of anything an unknown admin could have touched.

## Sources

- [NVD: CVE-2026-76578](https://nvd.nist.gov/vuln/detail/cve-2026-76578)
- [FreeIPA 4.13.4 release notes](https://www.freeipa.org/release-notes/4-13-4.html)
- [Red Hat: CVE-2026-76578](https://access.redhat.com/security/cve/CVE-2026-76578)