CVE-2019-14867: PYSEC-2026-636 - Code injection in FreeIPA

Quick answers

Is CVE-2019-14867 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-14867 being exploited in the wild.

How severe is CVE-2019-14867?

Low severity, with a CVSS score of 3.1, published 2 July 2026.

Which products and versions are affected?

freeipa (PyPI) ECOSYSTEM:introduced=4.6.2,fixed=4.6.7, ECOSYSTEM:introduced=4.6.2,fixed=4.6.7,introduced=4.7.0,fixed=4.7.4,introduced=4.8.0,fixed=4.8.3; ipa (PyPI) ECOSYSTEM:introduced=4.6.2,fixed=4.6.7, ECOSYSTEM:introduced=4.6.2,fixed=4.6.7,introduced=4.7.0,fixed=4.7.4,introduced=4.8.0,fixed=4.8.3.

Is there a fix for CVE-2019-14867?

Yes. freeipa (PyPI): upgrade to 4.6.7, 4.8.3 or later; ipa (PyPI): upgrade to 4.6.7, 4.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2019-14867?

Check whether you run freeipa (PyPI) or ipa (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• freeipa (PyPI): upgrade to 4.6.7, 4.8.3 or later

  pip install "freeipa>=4.8.3"

• ipa (PyPI): upgrade to 4.6.7, 4.8.3 or later

  pip install "ipa>=4.8.3"

Affected products

• freeipa (PyPI) ECOSYSTEM:introduced=4.6.2,fixed=4.6.7, ECOSYSTEM:introduced=4.6.2,fixed=4.6.7,introduced=4.7.0,fixed=4.7.4,introduced=4.8.0,fixed=4.8.3
• ipa (PyPI) ECOSYSTEM:introduced=4.6.2,fixed=4.6.7, ECOSYSTEM:introduced=4.6.2,fixed=4.6.7,introduced=4.7.0,fixed=4.7.4,introduced=4.8.0,fixed=4.8.3

Identifiers

• CVE-2019-14867
• GHSA-7hpj-hfcr-5qwm
• PYSEC-2019-28
• PYSEC-2026-636