# FreeIPA idp-add evaluates input before checking the caller's rights

Source: https://startwithidentity.com/cves/cve-2026-79678/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

The `idp-add` command registers an external identity provider in FreeIPA. The FreeIPA 4.13.4 release notes say the `--organization` and `--base-url` values had no input validation and flowed into `ipapython.ipautil.template_str()`, which evaluates `eval(...)` tokens. That evaluation ran in the LDAPCreate `pre_callback`, before the access control check, so "any authenticated IPA principal, regardless of privilege level, can trigger this evaluation." The CWE is CWE-95 (eval injection). Red Hat's CVE page says a regular expression that blocks parentheses prevents function calls, so the result is not code execution: the caller can enumerate and read the server process's environment variables and cause denial of service through memory exhaustion. NVD has not yet scored it; the CNA (Red Hat) score is CVSS 3.1 8.1. FreeIPA 4.13.4, tagged September 7, 2026, carries the fix. It is not on CISA KEV.

## Why it matters

The bug is an authorization order mistake inside the identity provider: the server did work on behalf of a principal before asking whether that principal was allowed to do it. Any ordinary user account, or a stolen one, became a reader of server memory. Red Hat says standard RPM installs hold only non-sensitive values in that environment, but in container deployments of the official FreeIPA image, Directory Manager and admin passwords supplied through an environment variable could be exposed if they stay in the process environment after setup. That turns a low-privilege login into the directory's root credential. It also ships alongside [CVE-2026-76578](https://startwithidentity.com/cves/cve-2026-76578/), an unauthenticated path to admin in the same release.

## What to do

- Upgrade to FreeIPA 4.13.4 or the Red Hat errata for your release. Red Hat lists no configuration workaround. The release applies permission and ACI checks before any callback runs, and adds an access check to all IPA API operations.
- For containers, confirm the `PASSWORD` environment variable is not present in the running server process, and pass setup secrets through a file or secret mount instead.

## After you patch

- If any container ran with admin or Directory Manager passwords in its environment, rotate both, then review `idp-add` calls in the IPA API logs for unexpected callers.

## Sources

- [NVD: CVE-2026-79678](https://nvd.nist.gov/vuln/detail/cve-2026-79678)
- [FreeIPA 4.13.4 release notes](https://www.freeipa.org/release-notes/4-13-4.html)
- [Red Hat: CVE-2026-79678](https://access.redhat.com/security/cve/CVE-2026-79678)