Is CVE-2026-79678 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79678 being exploited in the wild.

How severe is CVE-2026-79678?

High severity, with a CVSS score of 8.1, published 7 September 2026.

Is there a fix for CVE-2026-79678?

A patch was published on 2026-09-23: Red Hat advisory RHSA-2026:70564 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79678 attacked?

It is attacked over the network.

Am I affected by CVE-2026-79678?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79678: FreeIPA idp-add command authorization bypass allowing environment disclosure

CVE-2026-79678 · Severity: high · CVSS 8.1 · Published 2026-09-07

FreeIPA is an open-source identity management system used by enterprises to centralize authentication and access control. A flaw in the idp-add command allows any authenticated user to read sensitive server environment variables and trigger denial-of-service attacks by exhausting memory, bypassing proper authorization checks. This undermines the security model by exposing sensitive configuration and credentials to all users regardless of their privilege level.

Quick answers

Is CVE-2026-79678 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79678 being exploited in the wild.
How severe is CVE-2026-79678?: High severity, with a CVSS score of 8.1, published 7 September 2026.
Which products and versions are affected?: FreeIPA FreeIPA.
Is there a fix for CVE-2026-79678?: A patch was published on 2026-09-23: Red Hat advisory RHSA-2026:70564 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79678 attacked?: It is attacked over the network.
Am I affected by CVE-2026-79678?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a authorization bypass in FreeIPA's idp-add command where insufficiently validated --organization and --base-url parameters reach a constrained eval() call before LDAP access control checks are enforced. An authenticated IPA principal can exploit this by providing crafted input that executes code within the eval() context, allowing enumeration and reading of server process environment variables and triggering memory exhaustion via denial of service. The flaw affects all authenticated users regardless of privilege level, and patches are available via Red Hat security advisories (RHSA-2026:70564).

Affected products

FreeIPA FreeIPA

Timeline

2026-09-07: disclosed
2026-09-23: patched: Red Hat advisory RHSA-2026:70564

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.