Summary
| Parameter | Value |
|---|---|
| CVE ID (lead entry) | CVE-2026-11861 |
| Vulnerabilities covered | 2 (CVE-2026-11861, CVE-2026-13097) |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| Date Published | 2026-08-20 |
| Vendor | Red Hat |
| Product | FreeIPA / Red Hat Identity Management (IdM) |
| CVSS Score | 9.6 and 9.1 (critical) |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Two vulnerabilities have been found in FreeIPA — the project underlying Red Hat Identity Management — that break the core guarantee of an identity system: that an authenticated principal is who it claims to be.
CVE-2026-11861 (CVSS 9.6) — authentication bypass via Active Directory trust. When a trust relationship is configured between FreeIPA and Active Directory, AD users can bypass authentication to FreeIPA services — the web portal, the SMB server and the LDAP directory. The vector is impersonation of a client name in the Kerberos Ticket Granting Service (TGS), made possible by insufficient validation on the FreeIPA side.
CVE-2026-13097 (CVSS 9.1) — privilege escalation through equivalent principal names. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not account for equivalent representations of the same name. A user with sufficient LDAP write privileges can therefore create a service principal that impersonates an existing one.
Both lead to the same outcome: an attacker obtains an identity that was never granted to them — inside the system whose only job is to establish who is who.
Required Actions
- Apply the Red Hat security errata for
ipaand389-ds-basematching your RHEL release. Update FreeIPA installations outside the Red Hat channel to the version named in the upstream advisory. - Prioritise installations with an Active Directory trust. Those environments are exposed to the more severe of the two flaws — authentication bypass that does not require a FreeIPA account at all.
- Review service principals in the directory for recently created entries and for names that are spelling variants of existing principals. That is the direct indicator of CVE-2026-13097 exploitation.
- Verify who holds LDAP write privileges. Exploiting CVE-2026-13097 requires one, so reviewing IdM delegations and roles narrows the set of accounts able to use the flaw.
- Check KDC logs for unusual TGS requests originating from the trusted domain, particularly for the portal, SMB and LDAP services.
Who Is Affected?
These vulnerabilities affect organizations using FreeIPA or Red Hat Identity Management as the central identity directory for Linux systems — in Poland most often companies with large RHEL estates: banking, telecommunications, energy and large industrial operators.
Hybrid environments are especially exposed: FreeIPA serving Linux servers while Active Directory serves workstations and users, joined by a trust relationship. That is the most common IdM deployment pattern in larger organizations — and precisely the configuration CVE-2026-11861 operates in.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
