CVE-2026-19550
published 2026-08-11CVE-2026-19550: A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration…
PriorityP351high8.2CVSS 3.1
AVNACHPRLUINSCCHIHAN
EPSS
0.38%
30.9th percentile
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freeipa | freeipa | < 4.13.3 | 4.13.3 |
| red_hat | ipa | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
vendor_redhat·2026-08-11·CVSS 4.3
CVE-2026-19550 [MEDIUM] CWE-863 freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
Statement: This flaw only affects Identity Management (IdM/FreeIPA) servers where a cross-forest trust with Active Directory has been established (via ipa-adtrust-install and ipa trust-add). Servers without an
VulDB
Red Hat FreeIPA Trust Administration trust-fetch-domains privileges management
vuldb·2026-08-23·CVSS 8.2
CVE-2026-19550 [HIGH] Red Hat FreeIPA Trust Administration trust-fetch-domains privileges management
A vulnerability identified as critical has been detected in Red Hat FreeIPA. Affected by this vulnerability is the function trust-fetch-domains of the component Trust Administration. This manipulation causes improper privilege management.
This vulnerability appears as CVE-2026-19550. The attack may be initiated remotely. There is no available exploit.
GHSA
A flaw was found in FreeIPA.
ghsa_unreviewed·2026-08-11
CVE-2026-19550 [MEDIUM] CWE-863 A flaw was found in FreeIPA.
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-19550 freeipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes [fedora-all]
bugzilla·2026-08-11·CVSS 4.3
CVE-2026-19550 [MEDIUM] CVE-2026-19550 freeipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes [fedora-all]
CVE-2026-19550 freeipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in FreeIPA. The `trust-fetch-domains` command, used to refresh Active Directory trust topology, is gated only by the read-level ACI on the trust object (`System: Read Trust Information`, granted to any authenticated IPA user by default) rather than a trust-administration-level permission. Any authenticated, non-privileged IPA user can therefore invoke `ipa trust-fetch-domains`, which calls a roo
Bugzilla
CVE-2026-19550 freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
bugzilla·2026-08-11·CVSS 4.3
CVE-2026-19550 [MEDIUM] CVE-2026-19550 freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
CVE-2026-19550 freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes
A flaw was found in FreeIPA. The `trust-fetch-domains` command, used to refresh Active Directory trust topology, is gated only by the read-level ACI on the trust object (`System: Read Trust Information`, granted to any authenticated IPA user by default) rather than a trust-administration-level permission. Any authenticated, non-privileged IPA user can therefore invoke `ipa trust-fetch-domains`, which calls a root-owned oddjobd/D-Bus helper (`install/oddjob/com.redhat.idm.trust-fetch-domains.in`). When the caller supplies `--admin`/`--password`, the helper calls `kinit_password()` against a caller-chosen `--server` using attacker-supplied cr
https://access.redhat.com/errata/RHSA-2026:70564https://access.redhat.com/errata/RHSA-2026:72279https://access.redhat.com/errata/RHSA-2026:82935https://access.redhat.com/errata/RHSA-2026:83083https://access.redhat.com/errata/RHSA-2026:83084https://access.redhat.com/errata/RHSA-2026:83085https://access.redhat.com/errata/RHSA-2026:83460https://access.redhat.com/errata/RHSA-2026:83461https://access.redhat.com/security/cve/CVE-2026-19550https://bugzilla.redhat.com/show_bug.cgi?id=2514019
2026-08-11
Published