CVE-2026-11861
published 2026-08-20CVE-2026-11861: A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for…
PriorityP355high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.35%
27.4th percentile
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freeipa | freeipa | < 4.13.3 | 4.13.3 |
| red_hat | ipa | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_redhat9.6CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
vendor_redhat·2026-08-20·CVSS 9.6
CVE-2026-11861 [CRITICAL] CWE-266 FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.
Statement: This vulnerability is rated as Moderate because practical exploitation is significantly constrained by conditions that are unlikely to be met in most productio
GHSA
A flaw was found in FreeIPA.
ghsa_unreviewed·2026-08-20
CVE-2026-11861 [CRITICAL] CWE-266 A flaw was found in FreeIPA.
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-11861 freeipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships [fedora-all]
bugzilla·2026-08-20·CVSS 9.6
CVE-2026-11861 [CRITICAL] CVE-2026-11861 freeipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships [fedora-all]
CVE-2026-11861 freeipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
If trust relationship between FreeIPA and Active Directory is configured (established/created), AD users can bypass authentication of the FreeIPA portal, SMB server, LDAP directory and, presumably, any other GSSAPI services unauthorized, using impersonation in TGS, under certain conditions. In the worst case scenario a user could escalate their priveleges (permissions/rights) in FreeIPA domain. This is due to the fact that the portal, like other GSSAPI serv
Bugzilla
CVE-2026-11861 FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
bugzilla·2026-06-10·CVSS 9.6
CVE-2026-11861 [CRITICAL] CVE-2026-11861 FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
CVE-2026-11861 FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
If trust relationship between FreeIPA and Active Directory is configured (established/created), AD users can bypass authentication of the FreeIPA portal, SMB server, LDAP directory and, presumably, any other GSSAPI services unauthorized, using impersonation in TGS, under certain conditions. In the worst case scenario a user could escalate their priveleges (permissions/rights) in FreeIPA domain. This is due to the fact that the portal, like other GSSAPI services, is not configured to verify PAC certificates and trusts the TGS cname field.
https://access.redhat.com/errata/RHSA-2026:70564https://access.redhat.com/errata/RHSA-2026:72279https://access.redhat.com/errata/RHSA-2026:82935https://access.redhat.com/errata/RHSA-2026:83083https://access.redhat.com/errata/RHSA-2026:83084https://access.redhat.com/errata/RHSA-2026:83085https://access.redhat.com/errata/RHSA-2026:83460https://access.redhat.com/errata/RHSA-2026:83461https://access.redhat.com/security/cve/CVE-2026-11861https://bugzilla.redhat.com/show_bug.cgi?id=2487472
2026-08-20
Published