CVE-2026-73196: FreeIPA DoS Vulnerability via OTP Key

CVE-2026-73196 Overview

CVE-2026-73196 is a resource exhaustion vulnerability in FreeIPA, an integrated identity and authentication solution for Linux and Unix environments. A low-privileged authenticated user can submit an oversized One-Time Password (OTP) key value that the server decodes and re-encodes without enforcing size limits. This processing consumes excessive CPU and memory, degrading availability of the IPA service. The flaw is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
An authenticated attacker with minimal privileges can trigger a denial-of-service condition against the FreeIPA service, disrupting identity and authentication operations across dependent systems.

Affected Products

FreeIPA (identity management server)
Red Hat Identity Management (IdM) distributions bundling FreeIPA
Downstream Linux distributions shipping vulnerable FreeIPA packages

Discovery Timeline

2026-08-20 - CVE-2026-73196 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73196

Vulnerability Analysis

The vulnerability resides in FreeIPA's handling of OTP key values submitted by authenticated users. FreeIPA supports OTP tokens for multi-factor authentication and accepts a key value during token registration or update. The server decodes the submitted key and re-encodes it before storing or processing the token. This decode/encode operation runs without any upper bound on the input size.

When an attacker submits a very large key, the server allocates memory proportional to the input and spends CPU cycles transforming it. Repeated requests amplify the impact, exhausting server resources and blocking legitimate authentication traffic. The result is a denial-of-service condition affecting the availability of the IPA service.

Root Cause

The root cause is missing input size validation on OTP key material. The affected code path trusts the client-supplied key length and performs decoding and re-encoding operations before any bounds check occurs. This matches the [CWE-770] pattern of allocating resources without throttling or limits.

Attack Vector

Exploitation requires network access to the FreeIPA management interface and a valid low-privileged account. The attacker submits one or more OTP-related requests containing oversized key values. No user interaction is required, and the attack scope is unchanged. Confidentiality and integrity are not affected; only availability is impacted.

The vulnerability is described in prose because no verified proof-of-concept code has been published. See the Red Hat CVE-2026-73196 Advisory and Red Hat Bug Report #2474712 for vendor technical details.

Detection Methods for CVE-2026-73196

Indicators of Compromise

Sudden spikes in CPU or memory usage on FreeIPA/IdM servers not correlated with legitimate workload.
Repeated OTP token creation or update requests from a single authenticated user within a short window.
Slow or failing Kerberos and LDAP authentication requests during the resource spike.
Application logs from ipa-server showing unusually large payloads on OTP-related API calls.

Detection Strategies

Monitor FreeIPA API endpoints for requests with abnormally large ipatokenotpkey or related attribute values.
Correlate authenticated user sessions with request rate anomalies against OTP management endpoints.
Alert on process-level resource thresholds for ipa and 389-ds (Directory Server) daemons.

Monitoring Recommendations

Enable verbose audit logging on the FreeIPA server and forward logs to a centralized SIEM for baseline analysis.
Track per-user request volume against IdM APIs and flag deviations from historical norms.
Configure availability monitoring for Kerberos, LDAP, and HTTPS endpoints exposed by the IPA server.

How to Mitigate CVE-2026-73196

Immediate Actions Required

Apply vendor-supplied FreeIPA and Red Hat IdM updates as soon as they are available for your distribution.
Audit accounts with the ability to manage OTP tokens and remove unnecessary privileges.
Rate-limit or reverse-proxy access to the FreeIPA management API to constrain request volume from any single user.
Restrict network exposure of the IPA management interface to trusted administrative segments.

Patch Information

Refer to the Red Hat CVE-2026-73196 Advisory for package versions and errata IDs. Downstream distributions rebuild FreeIPA from upstream releases, so consult your distribution's security tracker for the specific fixed package version. Apply updates through the standard package manager and restart ipa services after installation.

Workarounds

Place a web application firewall or reverse proxy in front of the IPA HTTPS endpoint and enforce a request body size limit.
Reduce the number of accounts permitted to enroll or modify OTP tokens until patches are applied.
Increase resource monitoring and configure systemd service restart policies to recover from resource exhaustion events.

bash

# Example nginx reverse-proxy body size cap in front of FreeIPA
server {
    listen 443 ssl;
    server_name ipa.example.com;

    client_max_body_size 64k;

    location / {
        proxy_pass https://ipa-backend.internal;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}