# FreeIPA Critical Chain: Anonymous Admin via CVE-2026-76578

> Critical FreeIPA flaw chain (CVE-2026-76578, CVE-2026-76560) enables anonymous clients to forge admin credentials on default installations. Patch now.

- Published: 2026-09-08T12:24:28.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Identity Access, Kerberos, FreeIPA, 389 Directory Server, CVE-2026-76578
- CVEs: CVE-2026-76578 (CVSS 9.8), CVE-2026-76560 (CVSS 7.5), CVE-2026-79678 (CVSS 8.1), CVE-2026-13097
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html
- Canonical: https://runtimerebel.com/blog/freeipa-critical-chain-anonymous-admin-via-cve-2026-76578

## Key points

- Anonymous clients can create administrator credentials in FreeIPA, gaining full control over affected systems.
- FreeIPA versions prior to 4.13.4, particularly default installations utilizing 389 Directory Server, are affected.
- Immediately update FreeIPA to version 4.13.4 or apply Red Hat's provided temporary mitigations.

## Critical FreeIPA Flaw Chain Grants Anonymous Administrator Access

Runtime Rebel is issuing an urgent advisory regarding a critical [vulnerability](/glossary#vulnerability) chain affecting FreeIPA, Red Hat's integrated identity and access management solution. This sequence of flaws, tracked as [CVE-2026-76578](https://nvd.nist.gov/vuln/detail/CVE-2026-76578) and [CVE-2026-76560](https://nvd.nist.gov/vuln/detail/CVE-2026-76560), allows anonymous clients to bypass authentication and create reusable administrator credentials on default FreeIPA installations. While there is no confirmed in-the-wild exploitation, Red Hat has successfully reproduced the full attack chain, underscoring the severe risk to unpatched systems. Security professionals should prioritize understanding the details of this threat and applying the necessary updates.

## Technical Analysis of the Vulnerability Chain

The core of this critical vulnerability lies in the interaction between FreeIPA's [access control](/glossary#access-control) rules and a fundamental flaw in the 389 Directory Server, which FreeIPA uses to manage identities via LDAP.

### FreeIPA Unauthenticated Write ([CVE](/glossary#cve)-2026-76578)

The first component, [CVE-2026-76578](https://nvd.nist.gov/vuln/detail/CVE-2026-76578), stems from an access control rule (ACI) within FreeIPA. This ACI is intended to allow users to manage their own one-time-password (OTP) tokens. Crucially, the rule does not require a client to be authenticated or logged in, nor does it sufficiently restrict what other attributes can be written alongside the OTP token. Red Hat rates this FreeIPA flaw as critical with a preliminary [CVSS](/glossary#cvss) score of 9.8.

### 389 Directory Server Ownership Bypass (CVE-2026-76560)

The FreeIPA flaw becomes exploitable due to a secondary, distinct vulnerability in the 389 Directory Server itself, tracked as [CVE-2026-76560](https://nvd.nist.gov/vuln/detail/CVE-2026-76560). This directory server vulnerability affects a specific type of rule designed to ensure "only the authenticated owner of this entry" can modify it. The flaw lies in how the server compares the client's name against a stored ownership value: it performs a plain text comparison. An anonymous client, lacking an authenticated name, effectively presents an empty string. If the ownership fields for an entry are left blank, this empty string matches, allowing the anonymous client to bypass the ownership check. Red Hat scores this flaw at 7.5.

### The Attack Chain: From Anonymous to Admin

When combined, these two vulnerabilities create a potent [attack vector](/glossary#attack-vector). An anonymous client can leverage the FreeIPA ACI to create an OTP token entry. During this process, by leaving ownership fields blank, the client exploits the 389 Directory Server flaw to pass the ownership check. Critically, this allows the anonymous client to write arbitrary data, including a new Kerberos identity and password, directly into the directory. Red Hat confirmed that this technique grants the attacker genuine administrator-group membership and reusable administrator credentials on a default FreeIPA installation, even if that installation had no network access.

An earlier vulnerability, [CVE-2026-13097](https://nvd.nist.gov/vuln/detail/CVE-2026-13097), which was fixed in FreeIPA 4.13.3, addressed a Kerberos name collision that allowed impersonation of existing privileged accounts. However, this prior fix did not fully resolve the underlying unauthenticated write capability, paving the way for the current [CVE-2026-76578 exploit details](https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html) to reach the same practical outcome through a name of the attacker's choosing.

Furthermore, for deployments using Windows-style security identifiers, attackers can obtain Kerberos tickets containing [authorization](/glossary#authorization) data, extending their access to other critical FreeIPA services such as HTTP and Dogtag (FreeIPA's built-in certificate authority).

## Secondary Vulnerability: CVE-2026-79678

A separate but also important flaw, [CVE-2026-79678](https://nvd.nist.gov/vuln/detail/CVE-2026-79678), was disclosed alongside the chain. This vulnerability, rated 8.1 by Red Hat, affects the `idp-add` command in FreeIPA. It involves a Python `eval()` call that executes before permission checks, allowing any authenticated account on the server, regardless of its privileges, to reach this sensitive code. While bracket restrictions prevent direct code execution, an attacker can still read server process environment variables one at a time by observing error messages, or exhaust server memory. This poses a particular risk to containerized FreeIPA installations, where administrator passwords might persist as environment variables after initial setup.

## Affected Versions and [Patch](/glossary#patch) Guidance

The primary vulnerability chain, involving [CVE-2026-76578](https://nvd.nist.gov/vuln/detail/CVE-2026-76578) and [CVE-2026-76560](https://nvd.nist.gov/vuln/detail/CVE-2026-76560), affects FreeIPA installations using versions prior to 4.13.4. Red Hat's Identity Management product, which ships FreeIPA as the `ipa` package, is also affected. The fix for the FreeIPA component has been released in FreeIPA version 4.13.4. The directory server defect is in the access-control engine itself, not FreeIPA specific code.

The `idp-add` flaw ([CVE-2026-79678](https://nvd.nist.gov/vuln/detail/CVE-2026-79678)) also requires a fixed package.

## Actionable Recommendations and Mitigations

Defenders must act swiftly to prevent exploitation of these vulnerabilities. For those wondering [how to mitigate FreeIPA anonymous admin access](https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html) and other related issues, the most critical step is to apply updates.

*   **Patch Immediately:** The most effective defense is to upgrade FreeIPA to version 4.13.4 or newer. This addresses the FreeIPA component of the critical chain vulnerability. Follow your distribution's [FreeIPA 4.13.4 patch guidance](https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html) to ensure proper deployment.
*   **389 Directory Server Updates:** Ensure your 389 Directory Server is also updated to a version that addresses [CVE-2026-76560](https://nvd.nist.gov/vuln/detail/CVE-2026-76560). While Red Hat Directory Server does not ship a rule of the vulnerable shape by default, FreeIPA does, making the fix essential for FreeIPA users.
*   **Temporary Mitigations (for the chain):** Until a fixed package for the chain is available, Red Hat provides two temporary steps. These were not fully detailed in the source, so consult official Red Hat advisories for specifics.
*   **Address CVE-2026-79678:** A fixed package is required for the `idp-add` vulnerability. There are no configuration settings to mitigate this flaw.
*   **Environment Variable Best Practices:** For containerized FreeIPA deployments, ensure that sensitive credentials like Directory Manager and administrator passwords are not persistently stored as environment variables after initial setup. Regularly review and sanitize environment configurations.
*   **Monitor for Anomalous Activity:** Given the potential for unauthenticated administrative access, closely monitor FreeIPA and 389 Directory Server logs for any suspicious account creations, privilege escalations, or unusual access patterns.

Gia Bui of Calif is credited with reporting the FreeIPA chain and the directory-server flaw, while Calif working with Anthropic reported the `idp-add` flaw. Proactive patching and vigilant monitoring are essential to protect your identity management infrastructure from these significant threats.

**Related:** [Securing Model Context Protocol (MCP) Traffic with Cloudflare](/blog/securing-model-context-protocol-mcp-traffic-with-cloudflare), [Entra Log Analysis: Detecting Password Spray Attacks with PowerShell](/blog/entra-log-analysis-detecting-password-spray-attacks-with-powershell)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/freeipa-critical-chain-anonymous-admin-via-cve-2026-76578