CVE-2026-76578FreeIPA anonymous LDAP write plants a Kerberos principal in the admins group
What broke
FreeIPA lets users manage their own OTP tokens, and a default access control instruction (ACI) in default-aci.ldif grants that right with the bind rule userdn = "ldap:///self". The FreeIPA 4.13.4 release notes say that an unauthenticated LDAP client, using an anonymous bind or SASL ANONYMOUS, could create a self-managed OTP token entry, and because the ACI did not restrict which other attributes came with it, the client could inject "an arbitrary attacker-chosen Kerberos principal that does not yet exist." The enabling bug sits in 389 Directory Server: an empty DN satisfied the SELFDN ACI evaluator. That flaw is tracked separately. Red Hat's CVE page says the combination lets the attacker get the planted principal added to the administrators group, and that Red Hat confirmed exploitation against a default, unmodified FreeIPA installation. The CWE is CWE-306 (missing authentication for a critical function). NVD has not yet scored it; the CNA (Red Hat) score is CVSS 3.1 9.8. FreeIPA 4.13.4 was tagged on September 7, 2026. It is not on CISA KEV.
Why it matters
FreeIPA is the identity provider: it is the Kerberos KDC, the LDAP directory and the policy store for every enrolled Linux host. An anonymous network client that can mint a principal and put it in admins holds genuine administrator credentials, not a foothold. NVD's description adds that on SID-enabled deployments the attacker can also act against other IdM services, so the blast radius is every Kerberos service and LDAP consumer that trusts the realm. Red Hat notes that an earlier fix, CVE-2026-13097, blocked taking over the literal admin name, but the unauthenticated write stayed open.
What to do
- Upgrade to FreeIPA 4.13.4 or the Red Hat errata for your release. The new bind rule is
(userdn = "ldap:///self" and userdn = "ldap:///all"), which an empty anonymous DN cannot match, and the upgrade runs new21-*ACI scripts that deny anonymous modifications. - Update 389 Directory Server in the same change window.
- Until then, restrict ports 389 and 636 to trusted hosts. Red Hat says disabling anonymous binds blocks the path, but test first that nothing depends on them.
After you patch
- List members of
adminsand every principal created since your last known-good audit; remove any you cannot account for. - Review OTP token entries whose owner is unexpected, and rotate the keytabs and passwords of anything an unknown admin could have touched.
Sources
Related identity CVEs
Related on Start with Identity
- CVEFreeIPA idp-add evaluates input before checking the caller's rights
Any authenticated FreeIPA principal could push --organization or --base-url values into an eval() call that ran before the access check, reading the server proc
- GlossaryActive Directory
Microsoft's on-premises directory service, providing authentication, authorization, group policy, and a hierarchical store of users, computers, and groups for a
- BlogA FreeIPA flaw chain let an anonymous client write itself a reusable administrator credential
CVE-2026-76578 (CVSS 9.8) chains with a 389 Directory Server ownership-check bug so an unauthenticated client can create an OTP token entry, pass the ownership
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- GlossaryDirectory Service
A directory service is the system that stores an organization's identities and their attributes (users, groups, devices, service accounts) in one queryable data