CVE-2026-19550: FreeIPA Privilege Escalation Vulnerability

CVE-2026-19550 Overview

A flaw was found in FreeIPA affecting the trust-fetch-domains command. The command is gated by a read-only permission on the trust object rather than a trust-administration permission. An authenticated, non-privileged IPA user can trigger a privileged Active Directory (AD) trust refresh using an attacker-supplied server and credentials. This results in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data stored in the IPA Lightweight Directory Access Protocol (LDAP) directory. The weakness is classified as an incorrect authorization flaw [CWE-863].

Critical Impact
A low-privileged authenticated user can modify trusted-domain and ID-range identity data in the IPA directory by triggering an attacker-controlled AD trust refresh.

Affected Products

FreeIPA (see Red Hat advisory for affected package versions)
Red Hat Identity Management (IdM) distributions of FreeIPA
Downstream distributions bundling the vulnerable trust-fetch-domains command

Discovery Timeline

2026-08-11 - CVE-2026-19550 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19550

Vulnerability Analysis

FreeIPA exposes the trust-fetch-domains command to refresh information about domains reachable through an established AD trust. The command performs a privileged operation: it contacts a remote domain controller, retrieves trust topology, and writes trusted-domain and ID-range entries back into the IPA LDAP directory. Authorization for invoking this command should be reserved for trust administrators. Instead, the current implementation checks only a read-only permission on the trust object, which is granted to standard authenticated users. Any authenticated IPA user can therefore invoke the refresh with parameters they control, including the target server and the credentials used to bind to it.

Root Cause

The root cause is an incorrect authorization mapping [CWE-863]. A state-changing administrative action is gated by a permission that describes read access to trust metadata, not the ability to modify it. The permission model does not distinguish between reading trust configuration and executing a domain refresh that writes back to the directory.

Attack Vector

The attack is network-reachable and requires only low-privileged authentication. An attacker with any valid IPA account calls ipa trust-fetch-domains and supplies a domain controller under their control along with credentials for that controller. FreeIPA connects to the attacker-controlled server, treats the responses as authoritative trust topology, and persists the resulting trusted-domain and ID-range records in the IPA LDAP backend. The attacker can then influence identity mappings that downstream services rely on for authorization decisions.

No verified public proof-of-concept code is available. See the Red Hat CVE-2026-19550 Advisory and Red Hat Bug Report #2514019 for vendor-supplied technical detail.

Detection Methods for CVE-2026-19550

Indicators of Compromise

Invocations of ipa trust-fetch-domains by IPA accounts that are not members of the trust-administration role.
Unexpected modifications to cn=trusts,dc=example,dc=com or ID-range entries under cn=ranges,cn=etc in the IPA LDAP tree.
Outbound SMB, LDAP, or Kerberos connections from IPA servers to domain controllers that are not part of the sanctioned AD trust.

Detection Strategies

Enable and centralize FreeIPA management audit logging, then alert when trust-fetch-domains is invoked by non-privileged principals.
Monitor the dirsrv access log on IPA servers for modify operations against trust and ID-range entries correlated with non-administrator bind DNs.
Baseline the set of AD domain controllers the IPA server communicates with and alert on connections to unknown hosts.

Monitoring Recommendations

Forward IPA server logs, 389 Directory Server access logs, and SSSD logs to a centralized analytics platform for correlation.
Track changes to trusted-domain and ID-range LDAP objects with change-detection rules and periodic configuration snapshots.
Review IPA role and permission assignments regularly to confirm no unintended accounts hold trust-administration capabilities.

How to Mitigate CVE-2026-19550

Immediate Actions Required

Apply the fixed FreeIPA or Red Hat Identity Management packages published in the Red Hat CVE-2026-19550 Advisory as soon as they are available for your distribution.
Audit existing trusted-domain and ID-range entries in the IPA directory for unexpected modifications and restore known-good values if tampering is suspected.
Review recent invocations of trust-fetch-domains and identify any calls made by non-privileged accounts.

Patch Information

Red Hat tracks remediation for this issue under the vendor advisory referenced above and in Red Hat Bug Report #2514019. Consult the advisory for the exact package versions that reassign trust-fetch-domains to a trust-administration permission.

Workarounds

Restrict network access to the IPA API and Kerberos endpoints to trusted administrative subnets where practical.
Remove or tighten any custom roles that grant broad read access on trust objects to standard users until the patch is applied.
Increase monitoring of writes to trust and ID-range LDAP entries so unauthorized refreshes are detected quickly.

bash

# Configuration example: list current members of the trust admins role
ipa role-show "Trust Administrator" --all

# Review recent trust-fetch-domains activity in the IPA API audit log
grep 'trust_fetch_domains' /var/log/httpd/error_log

# Snapshot current trusted-domain and ID-range entries for change detection
ldapsearch -Y GSSAPI -b "cn=trusts,$(hostname -d | sed 's/\./,dc=/g;s/^/dc=/')"
ldapsearch -Y GSSAPI -b "cn=ranges,cn=etc,$(hostname -d | sed 's/\./,dc=/g;s/^/dc=/')"