Critical FreeIPA Flaw Chain Grants Anonymous Administrator Access
Runtime Rebel is issuing an urgent advisory regarding a critical vulnerability chain affecting FreeIPA, Red Hat’s integrated identity and access management solution. This sequence of flaws, tracked as CVE-2026-76578 and CVE-2026-76560, allows anonymous clients to bypass authentication and create reusable administrator credentials on default FreeIPA installations. While there is no confirmed in-the-wild exploitation, Red Hat has successfully reproduced the full attack chain, underscoring the severe risk to unpatched systems. Security professionals should prioritize understanding the details of this threat and applying the necessary updates.
Technical Analysis of the Vulnerability Chain
The core of this critical vulnerability lies in the interaction between FreeIPA’s access control rules and a fundamental flaw in the 389 Directory Server, which FreeIPA uses to manage identities via LDAP.
FreeIPA Unauthenticated Write (CVE-2026-76578)
The first component, CVE-2026-76578, stems from an access control rule (ACI) within FreeIPA. This ACI is intended to allow users to manage their own one-time-password (OTP) tokens. Crucially, the rule does not require a client to be authenticated or logged in, nor does it sufficiently restrict what other attributes can be written alongside the OTP token. Red Hat rates this FreeIPA flaw as critical with a preliminary CVSS score of 9.8.
389 Directory Server Ownership Bypass (CVE-2026-76560)
The FreeIPA flaw becomes exploitable due to a secondary, distinct vulnerability in the 389 Directory Server itself, tracked as CVE-2026-76560. This directory server vulnerability affects a specific type of rule designed to ensure “only the authenticated owner of this entry” can modify it. The flaw lies in how the server compares the client’s name against a stored ownership value: it performs a plain text comparison. An anonymous client, lacking an authenticated name, effectively presents an empty string. If the ownership fields for an entry are left blank, this empty string matches, allowing the anonymous client to bypass the ownership check. Red Hat scores this flaw at 7.5.
The Attack Chain: From Anonymous to Admin
When combined, these two vulnerabilities create a potent attack vector. An anonymous client can leverage the FreeIPA ACI to create an OTP token entry. During this process, by leaving ownership fields blank, the client exploits the 389 Directory Server flaw to pass the ownership check. Critically, this allows the anonymous client to write arbitrary data, including a new Kerberos identity and password, directly into the directory. Red Hat confirmed that this technique grants the attacker genuine administrator-group membership and reusable administrator credentials on a default FreeIPA installation, even if that installation had no network access.
An earlier vulnerability, CVE-2026-13097, which was fixed in FreeIPA 4.13.3, addressed a Kerberos name collision that allowed impersonation of existing privileged accounts. However, this prior fix did not fully resolve the underlying unauthenticated write capability, paving the way for the current CVE-2026-76578 exploit details to reach the same practical outcome through a name of the attacker’s choosing.
Furthermore, for deployments using Windows-style security identifiers, attackers can obtain Kerberos tickets containing authorization data, extending their access to other critical FreeIPA services such as HTTP and Dogtag (FreeIPA’s built-in certificate authority).
Secondary Vulnerability: CVE-2026-79678
A separate but also important flaw, CVE-2026-79678, was disclosed alongside the chain. This vulnerability, rated 8.1 by Red Hat, affects the idp-add command in FreeIPA. It involves a Python eval() call that executes before permission checks, allowing any authenticated account on the server, regardless of its privileges, to reach this sensitive code. While bracket restrictions prevent direct code execution, an attacker can still read server process environment variables one at a time by observing error messages, or exhaust server memory. This poses a particular risk to containerized FreeIPA installations, where administrator passwords might persist as environment variables after initial setup.
Affected Versions and Patch Guidance
The primary vulnerability chain, involving CVE-2026-76578 and CVE-2026-76560, affects FreeIPA installations using versions prior to 4.13.4. Red Hat’s Identity Management product, which ships FreeIPA as the ipa package, is also affected. The fix for the FreeIPA component has been released in FreeIPA version 4.13.4. The directory server defect is in the access-control engine itself, not FreeIPA specific code.
The idp-add flaw (CVE-2026-79678) also requires a fixed package.
Actionable Recommendations and Mitigations
Defenders must act swiftly to prevent exploitation of these vulnerabilities. For those wondering how to mitigate FreeIPA anonymous admin access and other related issues, the most critical step is to apply updates.
- Patch Immediately: The most effective defense is to upgrade FreeIPA to version 4.13.4 or newer. This addresses the FreeIPA component of the critical chain vulnerability. Follow your distribution’s FreeIPA 4.13.4 patch guidance to ensure proper deployment.
- 389 Directory Server Updates: Ensure your 389 Directory Server is also updated to a version that addresses CVE-2026-76560. While Red Hat Directory Server does not ship a rule of the vulnerable shape by default, FreeIPA does, making the fix essential for FreeIPA users.
- Temporary Mitigations (for the chain): Until a fixed package for the chain is available, Red Hat provides two temporary steps. These were not fully detailed in the source, so consult official Red Hat advisories for specifics.
- Address CVE-2026-79678: A fixed package is required for the
idp-addvulnerability. There are no configuration settings to mitigate this flaw. - Environment Variable Best Practices: For containerized FreeIPA deployments, ensure that sensitive credentials like Directory Manager and administrator passwords are not persistently stored as environment variables after initial setup. Regularly review and sanitize environment configurations.
- Monitor for Anomalous Activity: Given the potential for unauthenticated administrative access, closely monitor FreeIPA and 389 Directory Server logs for any suspicious account creations, privilege escalations, or unusual access patterns.
Gia Bui of Calif is credited with reporting the FreeIPA chain and the directory-server flaw, while Calif working with Anthropic reported the idp-add flaw. Proactive patching and vigilant monitoring are essential to protect your identity management infrastructure from these significant threats.
Related: Securing Model Context Protocol (MCP) Traffic with Cloudflare, Entra Log Analysis: Detecting Password Spray Attacks with PowerShell