A chain of vulnerabilities in FreeIPA and the underlying 389 Directory Server could let an anonymous client create a Kerberos identity and gain administrator-like credentials on a default install. Red Hat says CVE-2026-76578, a critical flaw in FreeIPA, can be exploited when an accompanying 389 Directory Server defect (CVE-2026-76560) is present.
The attack hinges on an access-control rule in FreeIPA that lets a user manage their one-time password token without requiring login, together with a separate directory-server rule that accepts an unauthenticated, blank owner field. An attacker can then inject a Kerberos identity and password, effectively becoming a privileged entity.
Red Hat and the FreeIPA project describe the outcome differently (genuine administrator-group membership vs. reusable administrator credentials), but both recognise the same practical risk. Red Hat reports reproducing the chain on a stock FreeIPA container (version 4.13.1) and notes no active exploitation to date.
The fixes arrived in three places: FreeIPA 4.13.4 to address both flaws; updates to 389-ds-base and related Red Hat Directory Server advisories (RHSA-2026:64785) for affected systems; and an idp-add related flaw (CVE-2026-79678) that permits potentially unauthorised access to identity-provider functionality. The latter involves an eval() call that can be reached without proper permission, though no code execution is possible due to a bracket-based restriction.
Administrators are advised to apply the relevant patches and, as interim measures, restrict LDAP access (ports 389/636) to trusted hosts and disable anonymous LDAP binds where feasible. The reports emphasise that it remains unclear whether applying updates will remove attacker-created identities or how to detect them, and that defenders should monitor for patch availability and verify container environment variables post-boot.