CVE-2026-11861: FreeIPA Auth Bypass Vulnerability

CVE-2026-11861 Overview

A flaw in FreeIPA allows Active Directory users to bypass authentication for FreeIPA services when a trust relationship is configured between the two directory systems. The vulnerability exists because FreeIPA services fail to verify Privilege Attribute Certificate (PAC) signatures on Ticket Granting Service (TGS) tickets. An authenticated Active Directory user can impersonate any client name and gain unauthorized access to the FreeIPA portal, SMB server, and LDAP directory. This authentication bypass leads to privilege escalation within the FreeIPA domain [CWE-266].

Critical Impact
An authenticated Active Directory user in a trusted domain can impersonate arbitrary FreeIPA principals and escalate privileges across FreeIPA services including LDAP, SMB, and the web portal.

Affected Products

FreeIPA (identity management server)
Red Hat Identity Management (IdM) deployments using FreeIPA with Active Directory trusts
Environments with cross-forest trust between FreeIPA and Active Directory

Discovery Timeline

2026-08-20 - CVE-2026-11861 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-11861

Vulnerability Analysis

FreeIPA uses Kerberos as its primary authentication protocol and supports cross-forest trusts with Active Directory. In a trust configuration, an Active Directory user requests a service ticket from the FreeIPA Key Distribution Center (KDC) through the Ticket Granting Service (TGS) exchange. The TGS response embeds a Privilege Attribute Certificate (PAC) that carries the requesting user's identity, group memberships, and security identifiers.

FreeIPA services accept these tickets without validating the PAC signatures. As a result, an attacker holding a valid Active Directory TGT can craft a TGS request that specifies an arbitrary client name in the PAC. The FreeIPA service treats the impersonated principal as authenticated and grants access under that identity.

The issue is an authentication bypass leading to vertical privilege escalation. Impacted services include the FreeIPA management portal, the integrated SMB file server, and the backing LDAP directory that stores identity data.

Root Cause

The root cause is missing verification of PAC signatures on service tickets received from a trusted Active Directory domain. Kerberos PAC validation requires FreeIPA services to check both the server signature and the KDC signature to confirm the PAC was issued by a trusted KDC and not tampered with. FreeIPA services skipped this check, allowing forged or modified PAC contents to be accepted as authoritative identity claims [CWE-266].

Attack Vector

Exploitation requires an authenticated account in the trusted Active Directory domain. The attacker requests a TGS ticket for a FreeIPA service and manipulates the client name in the PAC to impersonate a privileged FreeIPA principal such as an administrator. The attacker then presents the ticket to the target FreeIPA service. Because the service does not verify the PAC, it authorizes the request under the impersonated identity. The attacker gains privileged access to LDAP data, SMB shares, and portal administrative functions. See the Red Hat CVE Vulnerability Report and Red Hat Bugzilla Entry #2487472 for additional technical detail.

Detection Methods for CVE-2026-11861

Indicators of Compromise

Kerberos TGS-REQ events from Active Directory users referencing FreeIPA service principals followed by unexpected privileged actions in FreeIPA logs.
LDAP modifications performed by principals that do not typically administer the FreeIPA directory, especially originating from cross-realm tickets.
SMB access from AD-realm principals to FreeIPA shares outside normal usage patterns.
Portal administrative sessions authenticated with cross-realm Kerberos tickets.

Detection Strategies

Correlate FreeIPA KDC logs (/var/log/krb5kdc.log) with service access logs to identify tickets where the client realm differs from the acting principal after authentication.
Review the 389-ds access logs for LDAP binds and modifications tied to cross-realm principals performing privileged operations.
Baseline normal cross-forest Kerberos activity and alert on deviations targeting sensitive service principals such as HTTP/, cifs/, and ldap/.

Monitoring Recommendations

Forward FreeIPA KDC, 389-ds, Samba, and Apache HTTPD logs to a central SIEM for correlation.
Enable audit logging on FreeIPA LDAP for changes to cn=groups and cn=users containers, particularly admins group membership.
Monitor for privilege changes and password resets performed by AD-realm principals.

How to Mitigate CVE-2026-11861

Immediate Actions Required

Apply the FreeIPA security updates published by Red Hat and downstream distributions as soon as they are available for your platform.
Audit FreeIPA administrative group membership and recent LDAP modifications for signs of unauthorized changes.
Restrict which Active Directory users and groups are mapped to FreeIPA roles through ID views and external group memberships.
Rotate credentials and Kerberos keys for privileged FreeIPA accounts if compromise is suspected.

Patch Information

Red Hat tracks remediation in the Red Hat CVE Vulnerability Report and Red Hat Bugzilla Entry #2487472. Administrators should install the fixed FreeIPA and ipa-server packages for their Red Hat Enterprise Linux or Fedora release once published, then restart the ipa service to load the corrected PAC verification logic.

Workarounds

If patches are not yet available, consider temporarily disabling the cross-forest trust with Active Directory using ipa trust-del until the fix is deployed.
Limit network exposure of FreeIPA services (LDAP 389/636, SMB 445, HTTPS 443) to trusted management networks.
Reduce the scope of AD groups granted access to FreeIPA resources to the minimum required set of users.

bash

# Temporarily remove the AD trust until patched
ipa trust-del ad.example.com

# Verify no cross-realm trust remains
ipa trust-find

# After patching, re-establish the trust
ipa trust-add --type=ad ad.example.com --admin Administrator --password