CVE-2026-13097: FreeIPA Privilege Escalation Vulnerability

CVE-2026-13097 Overview

CVE-2026-13097 is a privilege escalation vulnerability in FreeIPA, the integrated identity management solution for Linux environments. The flaw resides in how the 389-ds directory server enforces uniqueness on Kerberos principal name attributes. The uniqueness constraint fails to normalize equivalent representations of the same principal name, permitting duplicate principals to coexist. An authenticated user with LDAP write privileges can create a service principal that impersonates an existing privileged principal. The attacker can then request Kerberos service tickets for sensitive services and escalate to full domain compromise. The vulnerability is tracked under [CWE-706: Use of Incorrectly-Resolved Name or Reference].

Critical Impact
Successful exploitation grants attackers Kerberos service tickets for privileged services, enabling full FreeIPA domain compromise.

Affected Products

FreeIPA identity management server
389-ds directory server component within FreeIPA deployments
Red Hat Identity Management (IdM) distributions built on FreeIPA

Discovery Timeline

2026-08-20 - CVE-2026-13097 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-13097

Vulnerability Analysis

FreeIPA relies on the 389-ds directory server to store and enforce integrity of Kerberos principal name attributes. The directory schema declares these attributes as unique, preventing two entries from claiming the same principal identity. The uniqueness check compares principal strings without canonicalizing equivalent forms. Two entries that resolve to the same logical principal name can therefore be accepted as distinct records.

An attacker with LDAP write access can leverage this weakness to register a service principal whose canonical form collides with a privileged existing principal such as HTTP/host.example.com or ldap/host.example.com. When the Kerberos Key Distribution Center (KDC) issues service tickets, it resolves principal lookups using the attacker-controlled entry. The attacker obtains valid Kerberos tickets for the impersonated service and gains access to resources protected by that service identity.

Root Cause

The root cause is improper name resolution in the 389-ds uniqueness plugin applied to Kerberos principal attributes. Equivalent principal representations, differing in encoding, case handling, or realm formatting, are not collapsed to a canonical form before comparison. The plugin treats textually distinct but semantically identical values as unique entries.

Attack Vector

Exploitation requires network access to the FreeIPA LDAP endpoint and an authenticated account with write privileges on relevant subtrees. The attacker submits an ldapadd or ldapmodify operation defining a service principal whose alternate representation matches a privileged principal. Once the entry is accepted, the attacker requests a Ticket Granting Service (TGS) ticket referencing the target service. The KDC returns a ticket bound to the malicious entry, which the attacker uses to authenticate as the privileged service.

No verified public exploit code is currently available. Refer to the Red Hat CVE-2026-13097 Advisory and Red Hat Bugzilla Entry #2515974 for authoritative technical detail.

Detection Methods for CVE-2026-13097

Indicators of Compromise

Duplicate or near-duplicate krbPrincipalName values across separate LDAP entries within the FreeIPA directory tree.
Unexpected creation of service principals referencing privileged hostnames such as HTTP/, ldap/, or host/ entries.
Kerberos TGS requests for privileged services originating from unusual client accounts or hosts.
LDAP write operations from accounts that do not normally administer service principals.

Detection Strategies

Audit krbPrincipalName and krbCanonicalName attributes across the directory and normalize values to identify equivalent representations.
Correlate 389-ds access logs with KDC ticket issuance logs to detect newly created principals immediately followed by TGS requests.
Alert on LDAP modifications to service principal entries performed outside of approved administrative workflows.

Monitoring Recommendations

Enable verbose logging for the 389-ds cn=config uniqueness plugin and forward events to a centralized log platform.
Monitor /var/log/dirsrv/slapd-*/access and KDC logs at /var/log/krb5kdc.log for anomalous principal creation events.
Baseline the set of service principals per host and alert on additions that do not match provisioning records.

How to Mitigate CVE-2026-13097

Immediate Actions Required

Apply vendor patches for FreeIPA and 389-ds as soon as they are made available through your distribution.
Review and restrict LDAP write privileges so only trusted administrative accounts can create or modify service principals.
Inventory existing service principals and remove or remediate entries whose canonical names collide with privileged services.

Patch Information

Refer to the Red Hat CVE-2026-13097 Advisory for the current list of fixed package versions and errata. Downstream distributions that ship FreeIPA and 389-ds will publish coordinated updates. Apply the patched packages on all IPA replicas and restart the ipa and dirsrv services to load the corrected uniqueness enforcement logic.

Workarounds

Tighten Access Control Instructions (ACIs) in 389-ds to limit which roles can write krbPrincipalName attributes.
Implement out-of-band review of service principal creation through change management until patches are applied.
Deploy monitoring rules that flag principal name collisions and alert administrators before tickets can be issued.

bash

# Example: list all service principals and inspect for duplicate canonical forms
ldapsearch -Y GSSAPI -b "cn=accounts,dc=example,dc=com" \
  "(objectClass=krbPrincipal)" krbPrincipalName krbCanonicalName \
  | awk '/krbPrincipalName|krbCanonicalName/ {print tolower($0)}' \
  | sort | uniq -d