CVE-2026-76578

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

This is a Critical flaw allowing complete, unauthenticated compromise of a FreeIPA/IdM server's administrative privileges. The technique originally disclosed impersonated the literal admin account via a canonical-name collision; a separate prior fix (CVE-2026-13097) now blocks that specific collision but does not address the underlying unauthenticated write access. The attack still succeeds by having the anonymously-created principal added to the administrators group under an attacker-chosen name, reaching the same practical outcome. Exploitation of the original collision-based technique has been independently confirmed by Red Hat against a default, unmodified FreeIPA installation and requires no credentials, user interaction, or prior access, only network reachability to the LDAP service. Any FreeIPA/IdM deployment exposing LDAP to an untrusted network should be considered at immediate risk until patched.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Until a fixed package is available, restrict network access to the LDAP service (typically ports 389/636) to trusted hosts only, using firewall rules or network segmentation. Disabling anonymous LDAP binds blocks this specific attack path, though administrators should confirm this does not break other required anonymous-bind functionality in their deployment before applying it.