CVE-2026-76578 in FreeIPA
Summary
by MITRE • 09/07/2026
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in FreeIPA represents a critical authentication bypass resulting from misconfigured Access Control Instructions within its LDAP infrastructure. Specifically, the self-managed One-Time Password token ACI fails to enforce mandatory authentication requirements for operations involving token entries. Furthermore, this configuration flaw allows an unauthenticated client to specify arbitrary attributes when adding or modifying these tokens without restriction. This lack of validation creates a significant security gap where any external actor can interact with the directory service without providing valid credentials, violating fundamental principles of secure access control and identity management integrity.
The exploitation of this vulnerability is compounded by a related flaw in the underlying 389 Directory Server's ACI evaluation logic. When an unauthenticated LDAP client leverages the permissive FreeIPA token configuration alongside the directory server's processing error, it enables the creation of arbitrary Kerberos principals controlled entirely by the attacker. These maliciously created principal entries are not isolated; they can be manipulated to include membership in the administrators group within the Identity Management system. This combination effectively allows an unauthenticated remote actor to forge administrative privileges that should only be granted through rigorous authentication and authorization processes.
The operational impact of this vulnerability is severe, as it grants a remote, unauthenticated attacker genuine administrator-group membership within the FreeIPA environment. With these elevated privileges, the attacker gains full control over the directory service, enabling them to perform any administrative operation supported by the system. This includes modifying user accounts, managing policies, and potentially compromising other Identity Management services in deployments where Security Identifier-based access is enabled. The ability to act as an administrator without prior authentication undermines the entire trust model of the identity infrastructure, leading to potential data exfiltration, lateral movement within the network, and complete compromise of organizational security posture.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to correctly verify the identity of users attempting administrative actions. It also relates to CWE-862 Missing Authorization, since the ACI misconfiguration allows unauthorized access to sensitive resources and functions. In terms of attack vectors, this scenario maps to MITRE ATT&CK techniques involving Initial Access through unauthenticated connections and Privilege Escalation via manipulation of identity management systems. The exploitation path demonstrates how configuration errors in directory services can be chained with software logic flaws to achieve high-impact outcomes.
Mitigation strategies must focus on immediate remediation of the ACI configurations within FreeIPA to enforce strict authentication requirements for all token-related operations. Administrators should review and restrict attribute modifications allowed during token entry creation or updates, ensuring that only predefined, safe attributes can be set by unauthenticated users. Additionally, applying patches provided by the FreeIPA maintainers is essential to address both the application-level ACI flaws and the underlying directory server evaluation issues. Regular auditing of access control rules and continuous monitoring for anomalous LDAP activity are recommended to detect potential exploitation attempts early. Ensuring that administrative groups require multi-factor authentication or stricter validation processes can further reduce the risk profile associated with identity management systems.