CVE-2026-79678 Overview
CVE-2026-79678 is a code injection flaw in FreeIPA's idp-add command. The command passes insufficiently validated --organization and --base-url input to a constrained eval() call before the corresponding Lightweight Directory Access Protocol (LDAP) access control check is enforced. Any authenticated IPA principal can trigger the vulnerable path, regardless of assigned privileges. Exploitation allows enumeration and disclosure of environment variables belonging to the affected server process. Attackers can also trigger denial of service through memory exhaustion. The vulnerability is tracked under CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code.
Critical Impact
Any authenticated FreeIPA user can read server process environment variables and exhaust server memory, bypassing LDAP access control checks entirely.
Affected Products
- FreeIPA (Identity, Policy, Audit) server
- Red Hat Identity Management distributions bundling the affected idp-add command
- Downstream Linux distributions packaging vulnerable FreeIPA releases
Discovery Timeline
- 2026-09-07 - CVE-2026-79678 published to the National Vulnerability Database (NVD)
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-79678
Vulnerability Analysis
The flaw sits in FreeIPA's Identity Provider (IdP) management workflow. When an authenticated principal invokes idp-add, the server processes the --organization and --base-url arguments through a constrained eval() call. The evaluation happens before the LDAP access control instruction (ACI) check that should restrict this operation to privileged administrators. This ordering error transforms a privileged administrative interface into a code path reachable by any authenticated Kerberos principal. The attack results in confidentiality loss through environment variable disclosure and availability loss through memory exhaustion.
Root Cause
The root cause combines two defects. First, the input validation applied to --organization and --base-url is insufficient to prevent abuse of the constrained eval() sandbox. Second, the authorization check that enforces IdP administrative privilege runs after the eval() invocation. The server therefore executes attacker-influenced expressions before determining whether the caller is entitled to invoke the command at all.
Attack Vector
An attacker requires only a valid Kerberos ticket for any IPA principal. The attacker calls ipa idp-add over the standard network-facing IPA API and supplies crafted values for --organization or --base-url. Constructed expressions can reference Python built-ins reachable inside the constrained evaluator to read os.environ contents, exposing secrets injected at process start such as database credentials, API keys, or bind passwords. Alternate payloads allocate large in-memory structures to exhaust process memory and force service restart or host-level pressure.
No verified public exploit code is available. See the Red Hat CVE-2026-79678 Advisory and Red Hat Bug Report #2523356 for vendor-supplied technical detail.
Detection Methods for CVE-2026-79678
Indicators of Compromise
- Unexpected idp-add API calls from user principals that do not hold IdP administrative roles.
- FreeIPA server process restarts correlated with sudden memory pressure or out-of-memory kills.
- Audit log entries showing --organization or --base-url arguments containing Python syntax such as attribute lookups, subscript operators, or comprehensions.
Detection Strategies
- Enable and centralize FreeIPA API audit logging, then alert on any idp-add invocation by principals outside the IdP administrator group.
- Baseline normal idp-add argument content and flag values containing non-printable characters, dunder attribute references, or unusually long strings.
- Monitor the FreeIPA server process for anomalous resident set size growth and correlate with concurrent API requests.
Monitoring Recommendations
- Ship FreeIPA httpd error logs, Kerberos KDC logs, and 389-ds access logs to a central analytics platform for correlation.
- Track authentication-to-API-call ratios per principal to surface low-privilege accounts issuing administrative commands.
- Alert on repeated idp-add failures returning access control errors, which indicate probing after the LDAP check finally executes.
How to Mitigate CVE-2026-79678
Immediate Actions Required
- Apply the vendor patch for FreeIPA as soon as it is available from your Linux distribution.
- Audit IdP administrator role membership and remove principals that do not require IdP management rights.
- Rotate any secrets exposed to the FreeIPA server process environment, including bind passwords and integration API keys.
- Restrict network reachability of the FreeIPA API to trusted administrative networks where feasible.
Patch Information
Refer to the Red Hat CVE-2026-79678 Advisory and Red Hat Bug Report #2523356 for fixed package versions and errata identifiers applicable to Red Hat Identity Management and downstream distributions.
Workarounds
- Restrict access to the FreeIPA management API through host-based firewalls until patches are installed.
- Minimize sensitive values in the FreeIPA server process environment by moving secrets to files with restrictive permissions read at runtime.
- Increase monitoring sensitivity on idp-add API endpoints and treat any invocation by non-administrative principals as a high-severity event pending patch deployment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
