CVE-2026-76578 Red Hat CVE debrief

Who should care

FreeIPA administrators and security teams should assess exposure and update configurations to restrict ACI and attribute modifications. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-76578 is a critical vulnerability in FreeIPA that allows unauthenticated attackers to gain administrator-group membership, potentially leading to unauthorized administrative access and lateral movement within deployments.

• Potential unauthorized administrative access to directory and IdM services
• Possible lateral movement within SID-enabled deployments
• Required verification of FreeIPA configurations and ACI restrictions
• Necessity for enhanced monitoring of directory and IdM services

Technical summary

A flaw in FreeIPA's self-managed OTP token ACI allows unauthenticated LDAP clients to create arbitrary Kerberos principals and add them to the administrators group. This is due to the ACI not requiring authentication and not restricting which attributes may be added alongside the token entry. The vulnerability can be exploited in combination with a related flaw in the underlying directory server's ACI evaluation to gain administrator-group membership and perform administrative operations against the directory and other IdM services.

Defensive priority

High

Recommended defensive actions

• Review and update FreeIPA configurations to restrict ACI and attribute modifications
• Implement additional authentication and authorization controls for LDAP clients
• Monitor directory and IdM services for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Official CVE Program and NVD records detail a critical vulnerability in FreeIPA, allowing unauthenticated attackers to gain administrator-group membership. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. This, combined with a related flaw in the underlying directory server's ACI evaluation, can be exploited to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.