Executive brief
FreeIPA is an open-source identity management platform widely deployed in enterprises to manage user authentication, authorization, and access control. When FreeIPA is configured to trust Active Directory domains, an authenticated Active Directory user can bypass authentication checks and impersonate any FreeIPA service user. This vulnerability bypasses the normal security protections that FreeIPA uses to verify service requests, allowing attackers to escalate privileges and gain unauthorized access to protected resources including portals, file servers, and LDAP directories.
Technical details
The vulnerability is a Kerberos Ticket Granting Service (TGS) impersonation flaw in FreeIPA's handling of cross-realm trust relationships with Active Directory. When an Active Directory user requests a TGS ticket for a FreeIPA service, FreeIPA fails to validate the Privilege Attribute Certificate (PAC) contained within the ticket, allowing an attacker to forge or manipulate the client name (cname) field. An authenticated Active Directory user can exploit this by crafting a malicious TGS request to impersonate legitimate FreeIPA service users, bypassing authentication checks for the portal, SMB server, LDAP directory, and other services. The vulnerability requires the attacker to be authenticated to Active Directory and for a trust relationship to be configured between FreeIPA and AD; no additional user interaction is required. Patches are available via Red Hat advisory RHSA-2026:70564.
Affected products
- Red Hat FreeIPA <UNKNOWN>
- Red Hat Red Hat Enterprise Linux 9 all
Timeline
- 2026-08-20: disclosed
- 2026-09-23: advisory: Red Hat advisory RHSA-2026:70564 issued