CVE-2026-11861 Red Hat CVE debrief

Who should care

System administrators and security teams managing FreeIPA and Active Directory environments, as well as users with access to FreeIPA services, should be aware of this vulnerability. They should verify and limit Active Directory user access to FreeIPA services, implement Privilege Attribute Certificate (PAC) certificate verification for FreeIPA services, and monitor and audit authentication attempts for suspicious activity. Additionally, they should review and restrict access to sensitive FreeIPA resources and apply vendor patches and updates for FreeIPA as needed. This includes IT staff responsible for identity and access management, security operations, and compliance within affected organizations.

Technical summary

A flaw in FreeIPA allows Active Directory users to bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory, by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain. The issue arises from the lack of verification of PAC certificates in FreeIPA services, which can be exploited by authenticated Active Directory users.

Defensive priority

Authenticated Active Directory users may escalate privileges within the FreeIPA domain; verify and limit AD user access.

Recommended defensive actions

• Verify and limit Active Directory user access to FreeIPA services
• Implement Privilege Attribute Certificate (PAC) certificate verification for FreeIPA services
• Monitor and audit authentication attempts for suspicious activity
• Apply vendor patches and updates for FreeIPA
• Review and restrict access to sensitive FreeIPA resources

Evidence notes

The vulnerability allows Active Directory users to bypass authentication for FreeIPA services by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This issue arises from the lack of verification of PAC certificates in FreeIPA services, which can be exploited by authenticated Active Directory users to escalate their privileges within the FreeIPA domain. To verify and mitigate this vulnerability, defenders should review FreeIPA and Active Directory configurations, verify user access controls, and implement Privilege Attribute Certificate (PAC) certificate verification for FreeIPA services.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.