> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials
- URL: https://f4n6.co.uk/security-feed/freeipa-flaw-chain-lets-anonymous-clients-create-reusable-administrator-credentials/
- Published: 2026-09-08T15:37:40.000Z
- Updated: 2026-09-08T15:37:40.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

Red Hat has disclosed a two-flaw chain that allows a completely unauthenticated network client to write a Kerberos identity of its own choosing into a default FreeIPA deployment and land in the administrators group, producing reusable administrator credentials. The chain combines CVE-2026-76578 (FreeIPA, rated critical, CVSS 9.8 — preliminary per Red Hat) with CVE-2026-76560 (389 Directory Server, CVSS 7.5); Red Hat reproduced it twice, including against a stock FreeIPA 4.13.1 container image on a machine with no access at all. FreeIPA has fixed its side in version 4.13.4; the 389 Directory Server side requires the directory-server fix, and deployments running the ipa package (Red Hat Identity Management) are in scope. No real-world exploitation is described in any of the advisories or bug reports. EMEA financial services running FreeIPA/IdM for Linux domain authentication should treat this as a high-priority patch event: the affected component is the identity backbone for Linux estates, and successful exploitation yields durable directory administrator access, not a crash or a denial of service.

## 2\. Regulatory framing

| Article                                                                         | Trigger (the fact in this item)                                                                                                                                                                                                          | Practical impact                                                                                                                                                                                                                      |
| ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 24: digital operational resilience testing — general requirements     | Red Hat reproduced full unauthenticated-to-administrator compromise on a default, unmodified FreeIPA install (stock 4.13.1 container image), meaning a standard deployment passes a vulnerability that resilience testing should surface | Clients with Linux identity infrastructure should include this chain in their Art. 24 testing scope — verify patched versions and test that the anonymous-write path is closed, rather than assuming default configuration is safe    |
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Exploitation yields reusable administrator credentials over the directory governing all Linux domain logins, and on SID-enabled deployments extends to HTTP and Dogtag certificate-authority services                                    | If a client detects exploitation, the credential-theft scope (CA compromise potential via Dogtag) is a fact pattern likely to meet major-incident classification under Art. 18 — prepare the reporting path now, before any detection |

No NIS2 or UK NIS article is directly engaged by the facts of this item beyond generic patching duties.

## 3\. Technical analysis & attack chain

### Confirmed attack chain (as reproduced by Red Hat on a default install)

1. An anonymous client — one that has never logged in and has no credentials — connects to the FreeIPA directory, which is a 389 Directory Server database accessed via LDAP.
2. FreeIPA ships a default access control rule (ACI) permitting a user to manage their own one-time-password token. This ACI does not require the client to have authenticated, and it does not restrict what else may be written alongside the token entry.
3. 389 Directory Server has a rule type intended to mean "only the authenticated owner of this entry." The ownership comparison is performed as a plain-text comparison of the client's name against a stored value. An unauthenticated client has an empty name, which matches an empty stored value — so "nobody" passes an ownership check against a blank ownership field.
4. The attacker creates a token entry with the ownership fields deliberately left blank, passes the ownership check by being anonymous, and writes a Kerberos identity and password alongside it.
5. The injected identity lands in the administrators group. Red Hat describes the result as genuine administrator-group membership and reusable administrator credentials; Red Hat verified the outcome using standard administrator-only commands rather than trusting the exploit's own output.

**Component split.** The defect sits in the 389 Directory Server access-control engine, not in FreeIPA logic: Red Hat reproduced the directory-server flaw independently on a plain 389-ds build with no FreeIPA components installed, and a control test using a non-empty value was correctly refused. However, the flaw only matters where a deployment has written an ACI of the vulnerable shape — and FreeIPA's shipped default rule is exactly that shape, which is why the chain works against an untouched install. Red Hat Directory Server ships no such rule by default. Note: the linkage of the two advisories into this chain is the source article's reading of two advisories that describe the halves separately — single-sourced interpretation; verify against the vendor advisories before enforcement action.

**Relationship to the earlier CVE-2026-13097 fix.** The technique as first reported to Red Hat impersonated the real admin account by creating a Kerberos name that matched it. The fix for CVE-2026-13097 (shipped in FreeIPA 4.13.3) blocked that name collision but left the underlying unauthenticated write intact. The attack now works under an attacker-chosen name instead, which Red Hat says reaches "the same practical outcome." CVE-2026-13097 itself was a distinct problem: the Kerberos-name uniqueness check did not account for different textual forms of the same name, allowing a user with write access to create a service identity impersonating an existing privileged one.

**Scope disagreement between the projects.** Red Hat characterises the result as administrator-group membership and reusable administrator credentials. The FreeIPA project states it more narrowly: the injected identity must not already exist, the CVE-2026-13097 fix prevents takeover of existing accounts, and the attack "may be used as a stepping stone" to administrative privileges. Treat the practical impact as at minimum a strong stepping-stone to full directory administration; the worst-case reading (direct admin group membership) is Red Hat's.

**SID-enabled deployments.** Where the deployment uses Windows-style security identifiers, Red Hat says the attacker can additionally obtain a Kerberos ticket containing authorization data, extending access to the server's HTTP and Dogtag services. Dogtag is FreeIPA's built-in certificate authority — this is the most serious extension of the chain, as it puts CA-adjacent services in reach.

**A second, separate flaw.** Red Hat disclosed a further FreeIPA flaw, CVE-2026-79678, alongside these; the source material is truncated mid-sentence and provides no detail on its mechanism or severity. Do not act on it from this advisory — obtain the vendor advisory directly.

**Exploitation status.** None of the advisories or bug reports describe the flaw being used in a real attack. No CISA-KEV state is available in the verified reference data for this item. No threat-actor attribution is present in the source material.

## 4\. Mitigation & containment

### P1 — within 24 hours

- **Inventory and patch FreeIPA.** Upgrade to FreeIPA 4.13.4, which fixes CVE-2026-76578\. Under Red Hat Identity Management the package is named `ipa` — check installed version across all IdM servers, not just replicas you believe are current. Any server at 4.13.1 (the version Red Hat used in reproduction) or below 4.13.4 is exposed.
- **Patch 389 Directory Server.** The chain requires the directory-server flaw (CVE-2026-76560); patching only the FreeIPA side leaves the underlying access-control engine defect in place. Apply the 389-ds fix on every directory server, including any 389-ds deployments that do not run FreeIPA but have custom ACIs of the vulnerable shape (an ACI relying on the "authenticated owner" rule type with entries whose ownership fields can be blank).
- **Audit for the write primitive.** Search directory logs and the database for token entries with blank ownership fields created by unauthenticated (anonymous LDAP) clients — any such entry is evidence the chain was exercised. Pay particular attention to Kerberos identities created alongside OTP token entries.

### P2 — within 72 hours

- **Restrict anonymous LDAP access at the network layer** for any server that cannot be patched immediately: firewall rules limiting access to the LDAP port to authenticated management hosts and known clients. This is a containment measure, not a fix — the ACI does not require login, so network exposure is the only lever available pre-patch.
- **Review administrator group membership** for identities created recently, especially any whose creation cannot be tied to a legitimate provisioning workflow. The CVE-2026-13097 fix prevents takeover of pre-existing accounts, so look for newly created identities rather than modified ones.
- **If the deployment uses Windows-style SIDs:** assess Dogtag (the built-in CA) and the HTTP service for unauthorised Kerberos ticket use, and consider whether any certificates issued since the exposure window need review.

### P3 — within 7 days

- **Verify the fix end-to-end.** Red Hat's own validation method is the model: run the chain (or a vendor-provided reproduction) against the patched deployment and confirm refusal, rather than trusting version numbers alone. Fold this into DORA Art. 24 resilience testing.
- **Confirm no custom ACIs of the vulnerable shape exist** in any 389 Directory Server deployment, including non-FreeIPA ones. Red Hat Directory Server ships no such rule by default, but custom deployments may have written one.
- **Track CVE-2026-79678.** The second, separate FreeIPA flaw disclosed alongside this chain has no detail in the available source; obtain the Red Hat advisory and assess it independently.

## 5\. Indicators of compromise

No atomic indicators of compromise are available in the source material. The advisories describe no real-world attacks, no exploit artefacts, and no attacker infrastructure.

**Behavioural indicators** (derived from the described attack mechanics; these are defensive hunting leads, not confirmed observed activity):

| Behaviour                                                                                                          | Where to observe                                                                | Confidence                                                                    |
| ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
| Anonymous (unauthenticated) LDAP client creating OTP token entries                                                 | 389 Directory Server access logs — anonymous binds followed by write operations | High — this is the prerequisite write primitive                               |
| Token entries created with blank ownership fields                                                                  | Directory database / LDAP audit of token entry attributes                       | High — required to pass the flawed ownership comparison                       |
| Kerberos identity and password written alongside a token entry                                                     | Directory write logs for token-entry DN subtrees                                | High — the core of the chain                                                  |
| Newly created Kerberos identities appearing in the administrators group without a corresponding provisioning event | FreeIPA group membership logs, admin group audits                               | Medium — Red Hat's characterisation; FreeIPA describes it as a stepping stone |
| Kerberos tickets containing authorization data used against HTTP and Dogtag services                               | KDC and HTTP/Dogtag service logs, on SID-enabled deployments only               | Medium — Red Hat-reported extension of the chain                              |

## 6\. Detection

Insufficient indicators to author detection rules. The source material contains no strings, command lines, file paths, registry keys, mutexes, or hashes belonging to an exploit or payload — only vulnerability mechanics, which do not translate into YARA or Sigma artefacts. The behavioural indicators in §5 should be implemented as log-analytics queries against 389-ds and FreeIPA logging rather than as detection rules.

## 7\. Sources

- The Hacker News, "FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials," https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html, 2026-09-08

## 8\. Adverse Trace position

This is a serious identity-layer flaw chain: unauthenticated-to-administrator on a default install, verified by the vendor twice including on an isolated machine, with a CA-adjacent extension on SID deployments — but with no observed exploitation and no KEV listing in the verified data, so we assess it as a high-priority patch event rather than an active threat. The 9.8 CVSS for CVE-2026-76578 is Red Hat's preliminary figure and subject to review; the practical severity for a specific client depends on whether FreeIPA/IdM fronts their Linux authentication estate, and for most EMEA financial services running Windows-centric identity the direct exposure will be limited to Linux domain infrastructure. The chain's two halves are described in separate advisories and their linkage is the source article's reading — single-sourced; verify against the vendor advisories before enforcement action. We will track the 389 Directory Server fix availability, any CISA-KEV addition, the truncated second flaw CVE-2026-79678, and any divergence between Red Hat's and FreeIPA's characterisation of the achievable privilege, and will update this advisory if exploitation emerges.

---

[Read the original source →](https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*