CVE-2026-13097
published 2026-08-20CVE-2026-13097: A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does…
PriorityP353high8.7CVSS 3.1
AVNACLPRHUINSCCHIHAN
EPSS
0.57%
46.5th percentile
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freeipa | freeipa | — | — |
| idm_client | ipa | — | — |
| red_hat | ipa | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.18.7HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
vendor_redhat·2026-09-07·CVSS 8.7
CVE-2026-76578 [HIGH] CWE-306 ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
Statement: This is a Critical
Red Hat
ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
vendor_redhat·2026-08-20·CVSS 9.1
CVE-2026-13097 [CRITICAL] CWE-706 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprisin
VulDB
Red Hat FreeIPA Kerberos Principal Name Uniqueness privileges management (EUVD-2026-63243)
vuldb·2026-09-08·CVSS 8.7
CVE-2026-13097 [HIGH] Red Hat FreeIPA Kerberos Principal Name Uniqueness privileges management (EUVD-2026-63243)
A vulnerability labeled as very critical has been found in Red Hat FreeIPA. This affects an unknown part of the component Kerberos Principal Name Uniqueness. The manipulation results in improper privilege management.
This vulnerability was named CVE-2026-13097. The attack may be performed from remote. There is no available exploit.
GHSA
A privilege escalation flaw was found in FreeIPA.
ghsa_unreviewed·2026-08-20
CVE-2026-13097 [CRITICAL] CWE-706 A privilege escalation flaw was found in FreeIPA.
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-76578 freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI [fedora-all]
bugzilla·2026-10-18·CVSS 8.7
CVE-2026-76578 [HIGH] CVE-2026-76578 freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI [fedora-all]
CVE-2026-76578 freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An unauthenticated LDAP client (anonymous bind or SASL ANONYMOUS) can create a self-managed OTP token entry with empty ipaTokenOwner/managedBy attributes, which satisfy 389 Directory Server's SELFDN ACI evaluator against the anonymous bind's own empty DN (see companion 389-ds flaw for that underlying defect). FreeIPA's self-managed-token ACI (install/share/default-aci.ldif) does not restrict which other attributes may be added,
Bugzilla
CVE-2026-13097 freeipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore [fedora-all]
bugzilla·2026-08-20·CVSS 9.1
CVE-2026-13097 [CRITICAL] CVE-2026-13097 freeipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore [fedora-all]
CVE-2026-13097 freeipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
I'd like to report a privilege escalation method based on manipulation of the krbCanonicalName attribute. Despite changes made by FreeIPA and PAC certificate validation, it can still be abused.
Requirements to exploit: The attacker must have the rights of the computer account or an account with the right to add to almost any branch of the LDAP directory.
Version affected: FreeIPA VERSION: 4.12.2, API_VERSIO
Bugzilla
CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
bugzilla·2026-08-14·CVSS 9.1
CVE-2026-13097 [CRITICAL] CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore
I'd like to report a privilege escalation method based on manipulation of the krbCanonicalName attribute. Despite changes made by FreeIPA and PAC certificate validation, it can still be abused.
Requirements to exploit: The attacker must have the rights of the computer account or an account with the right to add to almost any branch of the LDAP directory.
Version affected: FreeIPA VERSION: 4.12.2, API_VERSION: 2.254
Patch available: no
CVSS 3.1 Vector
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
You're familiar with the general information on vulnerabilities CVE-2025-4404 and CVE-2025-7493.
But there's a method that can currently be exploited, and it's
Hackernews
FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials
blogs_hackernews·2026-09-08·CVSS 7.5
CVE-2026-76578 [HIGH] FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials
A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group, Red Hat says.
FreeIPA is the system that determines who may log in across a Linux domain and maintains all identities in a 389 Directory Server database accessed via LDAP. The attack needs a second flaw in that database software.
The FreeIPA project has already fixed its side in version 4.13.4 . Red Hat says it reproduced the chain twice on a default installation, most recently on a
https://access.redhat.com/errata/RHSA-2026:70564https://access.redhat.com/errata/RHSA-2026:72279https://access.redhat.com/errata/RHSA-2026:82935https://access.redhat.com/errata/RHSA-2026:83083https://access.redhat.com/errata/RHSA-2026:83084https://access.redhat.com/errata/RHSA-2026:83085https://access.redhat.com/errata/RHSA-2026:83460https://access.redhat.com/errata/RHSA-2026:83461https://access.redhat.com/security/cve/CVE-2026-13097https://bugzilla.redhat.com/show_bug.cgi?id=2515974
2026-08-20
Published