CVE-2026-76578

Think of FreeIPA as the “front desk” that manages who has access to your systems and services. This issue lets someone who connects from the network without an account quietly register themselves as an administrator, like walking into the building and being added to the security staff list—without being recognized first.

This matters if your business uses FreeIPA running on Red Hat Enterprise Linux to manage identities and authentication for users and services. It’s most relevant if your FreeIPA LDAP endpoint is reachable from the network (the default configuration is reachable), because the attacker does not need an account. This is a risk when the attacker can reach the vulnerable LDAP service from outside your trusted network.

This is a RED issue because an attacker can gain full administrative control without any account, directly from the network. Even though there’s no clear public dated report of exploitation in the provided findings, the exposure is high and the impact is total identity takeover. Treat it as urgent containment and remediation work.

Confirm exposure

1. Verify where FreeIPA is hosted and whether it is reachable from untrusted networks.
   • Determine whether inbound LDAP connections to your FreeIPA servers are allowed from the internet, guest Wi‑Fi, partner networks, or other broad segments.
   • Confirm firewall/security group rules and any reverse proxies/load balancers that might expose LDAP.

Confirm affected software

2. On each FreeIPA host, record the exact Red Hat Enterprise Linux release and the FreeIPA version/build installed.
3. Confirm that the vulnerable “self-managed-token ACI” behavior is present in your deployment (vendor documentation/support can confirm this for your specific versions).

Get the official fix

4. The provided findings state that no fix/patch information is available. Contact Red Hat support (or your managed service provider) for:
   • Whether a patch or fixed FreeIPA update exists for your exact versions
   • The upgrade path and any required configuration changes
   • Any interim mitigations they recommend.

Immediate mitigation (if you cannot yet confirm the fixed release)

5. Restrict LDAP access to reduce the chance of remote reachability:
   • Allow LDAP (and any related ports used by FreeIPA) only from approved admin networks/IP addresses or a VPN.
   • Block all other inbound LDAP traffic to FreeIPA.
   • If you have internal-only access patterns, ensure the service is not exposed via public routing.

What to monitor

6. After tightening network access (and after applying any vendor fix once available), monitor for:
   • Unexpected administrative group membership changes in FreeIPA
   • Unusual creation of Kerberos principals or admin-equivalent identities
   • Authentication/authorization anomalies affecting identity management.

Timing note

7. Because the traffic-light verdict is RED and the weakness is remotely triggerable without authentication, treat this as an immediate containment item while waiting for the vendor’s official fix guidance.

What’s happening

• Weakness: CWE-306 (missing authorization).
• Mechanism: FreeIPA’s “self-managed-token ACI” is exploitable through an unauthenticated LDAP client. The ACI does not require authentication and does not properly restrict which attributes can be added alongside the token entry.
• Effect: Combined with a related directory server ACI evaluation issue (tracked separately), an attacker can cause an attacker-controlled Kerberos principal to be added to the FreeIPA administrators group.

Attack characteristics (from findings)

• Network attack vector.
• No authentication required.
• No user interaction required.
• Reachable in default configuration: yes.

Exploitation and availability of fixes

• KEV: not listed.
• Press/incidents: no clear dated claim of exploitation and no incidents reported in the provided findings.
• Public exploit code: none on record.
• Patch availability: no fix/patch information available in the provided findings.

Operational significance

• Once an attacker gains genuine administrator-group membership, they can perform administrative operations against the directory and, on SID-enabled deployments, potentially other IdM services—enabling full identity infrastructure compromise.