CVE-2026-76578: FreeIPA Authentication Bypass Vulnerability

CVE-2026-76578 Overview

A missing authentication flaw in FreeIPA allows unauthenticated remote attackers to obtain administrator-group membership. The self-managed one-time password (OTP) token Access Control Instruction (ACI) does not require authentication. It also fails to restrict which Lightweight Directory Access Protocol (LDAP) attributes may be added alongside the token entry. When combined with a related ACI evaluation flaw in the underlying directory server, an attacker can create an arbitrary Kerberos principal and add it to the administrators group. On Security Identifier (SID)-enabled deployments, this exposes additional Identity Management (IdM) services to compromise. The weakness is classified under [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Remote unauthenticated attackers can obtain genuine FreeIPA administrator privileges and execute administrative operations against the directory and integrated IdM services.

Affected Products

FreeIPA (see Red Hat CVE-2026-76578 Advisory for affected versions)
Red Hat Identity Management deployments using FreeIPA
SID-enabled FreeIPA deployments integrating additional IdM services

Discovery Timeline

2026-09-07 - CVE-2026-76578 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-76578

Vulnerability Analysis

FreeIPA relies on LDAP ACIs to restrict who may create or modify directory entries. The self-managed OTP token ACI is designed to allow users to provision their own OTP tokens without administrator intervention. This ACI omits an authentication requirement and does not constrain which attributes accompany the token entry.

An attacker submitting an LDAP add operation can attach arbitrary attributes to a token entry. When paired with the tracked ACI evaluation flaw in the directory server, the write is accepted without a bound identity. The attacker uses this primitive to create a Kerberos principal under attacker control and place it in the administrators group. The resulting account carries genuine administrative rights across the FreeIPA directory.

Root Cause

The root cause is a missing authentication check on a critical LDAP operation. The self-managed OTP token ACI does not enforce that the caller is authenticated. It also fails to bound the attribute set permitted during token creation. This violates the principle that ACIs granting write access to security-relevant containers require an authenticated bind and strict attribute allow-lists.

Attack Vector

The attack is network-reachable and requires no privileges or user interaction. An attacker connects to the exposed LDAP service on a FreeIPA server. The attacker issues an unauthenticated add request that creates a token entry and injects attributes defining a new Kerberos principal. The principal is then associated with the administrators group. Once the principal exists with administrator membership, the attacker authenticates as that principal and performs administrative operations. On SID-enabled deployments, the compromise extends to integrated IdM services that trust the directory.

No verified public proof-of-concept code is available. See the Red Hat Bug Report #2519522 for the vendor's technical description.

Detection Methods for CVE-2026-76578

Indicators of Compromise

Unexpected Kerberos principals created without a corresponding administrative session or provisioning ticket.
Membership additions to the administrators group that do not map to a legitimate identity management change request.
LDAP add operations targeting OTP token containers from anonymous or unauthenticated binds.
New administrator logins originating from unusual source addresses or during off-hours windows.

Detection Strategies

Enable and review Directory Server access and audit logs for LDAP add operations under the OTP token subtree, particularly those tied to anonymous binds.
Alert on any modification to the cn=admins group membership and correlate the change with an authenticated administrative session.
Baseline legitimate Kerberos principal creation patterns and flag deviations, including bursts of new principals within short windows.

Monitoring Recommendations

Forward FreeIPA dirsrv access logs, Kerberos KDC logs, and IdM audit events to a centralized SIEM for correlation.
Monitor group membership deltas on privileged groups (admins, trust admins) using scheduled LDAP queries and alert on any additions.
Track anonymous or unauthenticated LDAP operations against production FreeIPA replicas and treat any write attempt as a high-severity event.

How to Mitigate CVE-2026-76578

Immediate Actions Required

Apply the FreeIPA security update referenced in the Red Hat CVE-2026-76578 Advisory to all replicas as soon as it is available for your distribution.
Restrict network exposure of LDAP (389/636) and Kerberos (88) ports on FreeIPA servers to trusted management networks only.
Audit the administrators group and Kerberos principal inventory for unrecognized entries and remove any that cannot be attributed to a legitimate change.
Rotate credentials for confirmed or suspected compromised administrative principals.

Patch Information

Refer to the Red Hat CVE-2026-76578 Advisory and Red Hat Bug Report #2519522 for fixed package versions and downstream distribution updates. This vulnerability requires coordinated patching of both FreeIPA and the underlying 389 Directory Server to fully close the exploitation chain.

Workarounds

Disable anonymous LDAP binds on the FreeIPA directory server until patches are applied.
Tighten or temporarily remove the self-managed OTP token ACI to require an authenticated bind and constrain permitted attributes.
Place FreeIPA management interfaces behind a bastion or VPN and block direct external access to LDAP and Kerberos services.
Increase auditing verbosity on the directory server to capture all writes to the OTP token and group membership containers.