CVE-2026-73199: IPA Enrollment Plugin DoS Vulnerability

CVE-2026-73199 Overview

CVE-2026-73199 is a null pointer dereference vulnerability [CWE-476] in the ipa-enrollment Server-Side Library for Plugins (SLAPI) plugin. An authenticated remote client can crash the directory server by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. The attack omits the request value for the JOIN_OID in the ipa-enrollment extended operation, triggering the dereference. A successful exploit produces a denial of service by terminating the affected server process.

Critical Impact
An authenticated LDAP client can crash the ipa-enrollment service by sending an extended operation missing the JOIN_OID request value, disrupting identity and enrollment services.

Affected Products

Red Hat products shipping the ipa-enrollment SLAPI plugin (see Red Hat advisory)
FreeIPA / Identity Management deployments using the affected plugin
LDAP directory servers loading the ipa-enrollment extended operation handler

Discovery Timeline

2026-08-20 - CVE-2026-73199 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73199

Vulnerability Analysis

The ipa-enrollment SLAPI plugin extends the directory server with an LDAP extended operation used during host enrollment. The plugin registers a handler for the JOIN_OID extended operation identifier. When a client issues that extended operation, the handler parses the request value supplied in the LDAP message. The parser assumes the request value is present and proceeds to dereference the pointer that would hold it.

An authenticated attacker can send an extended operation with the JOIN_OID identifier but no request value. The handler dereferences the resulting null pointer, causing the server process to crash. The crash terminates directory server responsiveness for all clients until the service restarts, producing a denial of service against identity management operations that depend on the directory.

Root Cause

The root cause is missing validation of the request value in the ipa-enrollment extended operation handler. The code path does not check whether the request value pointer is non-null before dereferencing it, satisfying the conditions for [CWE-476] Null Pointer Dereference.

Attack Vector

Exploitation requires network access to the LDAP service and valid authentication credentials. The attacker binds to the directory, then issues a single LDAP extended operation with the JOIN_OID OID and an empty request value. No user interaction, elevated privileges, or additional protocol interaction is required. See the Red Hat CVE-2026-73199 Security Advisory and Red Hat Bug Report #2471741 for further technical detail.

No verified exploit code is available. The vulnerability is triggered by an LDAP extended
operation carrying the ipa-enrollment JOIN_OID with a missing request value.

Detection Methods for CVE-2026-73199

Indicators of Compromise

Unexpected termination or repeated restarts of the dirsrv (389 Directory Server) process hosting the ipa-enrollment plugin.
Directory server error logs referencing the ipa-enrollment plugin, JOIN_OID, or a segmentation fault at the time of the crash.
LDAP extended operation requests targeting the JOIN_OID OID with an empty or absent request value in packet captures.

Detection Strategies

Alert on dirsrv process crashes or systemd unit restart events on IPA servers.
Inspect LDAP audit logs for extended operations issued by authenticated principals immediately preceding directory server termination.
Correlate authentication events with subsequent extended operation failures to identify the source principal used in the attack.

Monitoring Recommendations

Forward dirsrv access, error, and audit logs to a centralized logging platform for correlation and retention.
Track service availability of IPA replicas and alert on unplanned downtime or replication gaps.
Baseline the volume and OIDs of extended operations to detect anomalous use of JOIN_OID.

How to Mitigate CVE-2026-73199

Immediate Actions Required

Apply vendor updates for the ipa-enrollment SLAPI plugin as released through Red Hat and downstream distributions.
Restrict LDAP bind privileges so that only trusted enrollment principals can issue extended operations against IPA servers.
Deploy IPA in a replicated topology so that a crashed replica does not eliminate directory availability.

Patch Information

Refer to the Red Hat CVE-2026-73199 Security Advisory for the list of affected packages and fixed versions. Track remediation state through Red Hat Bug Report #2471741. Apply the vendor-supplied errata to all IPA masters and replicas.

Workarounds

Limit network reachability of the LDAP service (typically TCP/389 and TCP/636) to enrollment hosts and administrative networks.
Revoke or rotate credentials for service accounts that do not require enrollment extended operations.
Configure automated restart of the dirsrv service to reduce downtime while patching is in progress.

bash

# Restrict LDAP access to trusted enrollment subnets (example firewalld rule)
firewall-cmd --permanent --zone=internal --add-source=10.0.0.0/24
firewall-cmd --permanent --zone=internal --add-service=ldap
firewall-cmd --permanent --zone=internal --add-service=ldaps
firewall-cmd --permanent --zone=public --remove-service=ldap
firewall-cmd --permanent --zone=public --remove-service=ldaps
firewall-cmd --reload