CVE-2026-19550 in FreeIPA
Summary
by MITRE • 08/12/2026
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability in FreeIPA represents a critical authorization flaw that undermines the security model of the identity management system. The issue stems from improper permission gating in the trust-fetch-domains command implementation, where the system relies on read-only access permissions rather than the more restrictive administrative privileges required for trust operations. This misconfiguration creates an escalation path that allows any authenticated user within the IPA environment to manipulate Active Directory trust relationships without proper authorization. The vulnerability specifically targets the privilege separation mechanisms that should prevent standard users from performing administrative tasks related to cross-domain authentication.
The technical exploitation of this flaw occurs through the manipulation of the trust-fetch-domains command which can be triggered by any authenticated user with basic read permissions on trust objects. When executed, this command allows attackers to specify arbitrary Active Directory servers and credentials, enabling them to force a refresh of trust relationships with attacker-controlled domains. This process results in unauthorized modifications to the IPA LDAP directory where trusted-domain configurations and ID-range identity mappings are stored. The underlying issue resides in the insufficient privilege validation that should occur before executing administrative operations on trust relationships, creating an opportunity for privilege escalation through legitimate system interfaces.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass complete compromise of cross-domain identity management within the IPA environment. Attackers can leverage this flaw to inject malicious domain mappings, manipulate user and group identity ranges, and potentially establish backdoor access paths into trusted domains. The modification of trusted-domain data affects the entire federation of identities managed by FreeIPA, potentially allowing attackers to impersonate users from trusted domains or gain elevated privileges within the IPA directory structure. This vulnerability particularly impacts organizations relying on Active Directory trust relationships for unified identity management, as it undermines the security boundaries between different domain environments.
Organizations should implement immediate mitigations including restricting access to the trust-fetch-domains command through proper RBAC configurations and ensuring that only trusted administrators possess the necessary permissions to execute trust-related operations. The recommended approach involves enforcing strict privilege separation where administrative trust operations require explicit trust-administration permissions rather than read-only access. Additionally, monitoring and logging of all trust-fetch-domains command executions should be enabled to detect unauthorized attempts to manipulate cross-domain relationships. Security teams must also review and validate existing trust configurations to identify any potential compromise from previous exploitation attempts.
This vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic case of insufficient privilege checking in administrative interfaces. The flaw demonstrates how improper permission model implementation can create dangerous escalation paths within identity management systems, similar to issues commonly found in directory service implementations. From an ATT&CK perspective, this vulnerability maps to privilege escalation techniques through legitimate system tools and command-line interfaces, specifically targeting the T1068 (Local Privilege Escalation) and T1550 (Use of Untrusted or Modified Components) tactics. Organizations should consider implementing principle of least privilege enforcement and regular security audits of administrative command interfaces to prevent similar authorization bypass vulnerabilities in other identity management systems.