FreeIPA Flaw Chain Allows Unauthenticated Admin Takeover

A critical vulnerability chain in FreeIPA and 389 Directory Server allows unauthenticated LDAP clients to create their own Kerberos identities and seize administrator privileges. The flaw poses a severe risk to organizations using the software for centralized identity management, as it enables a complete takeover of the identity infrastructure.

The attack leverages a combination of two vulnerabilities: CVE-2026-76578 in FreeIPA and CVE-2026-76560 in 389 Directory Server. According to the FreeIPA Project, an unauthenticated LDAP client can obtain administrator credentials via the "self-managed-token" access control rule (ACI). Technically, an anonymous client can create a token entry with blank ownership fields; 389 Directory Server then incorrectly validates these blank fields as a match for the anonymous client's own empty name. This logic error allows the attacker to write a Kerberos identity and password directly into the system.

The Path to Privilege

FreeIPA serves as a centralized identity management system for Linux domains, relying on 389 Directory Server for LDAP storage and MIT Kerberos for authentication. This specific flaw chain is particularly dangerous because it works on default installations of the software.

This discovery follows a previous security effort to harden the system. A prior fix, identified as CVE-2026-13097, was designed to block attackers from impersonating existing administrator accounts through name collisions. However, while that patch stopped the impersonation of known accounts, it failed to address the underlying unauthenticated write vulnerability. This left a gap that allowed attackers to simply create entirely new privileged identities rather than hijacking existing ones.

Industry Implications

Red Hat has rated the primary flaw, CVE-2026-76578, as critical, assigning it a preliminary CVSS score of 9.8. The severity stems from the fact that no prior authentication is required to trigger the chain, meaning any client with network access to the LDAP service could potentially escalate to full domain administrator.

For organizations utilizing FreeIPA, the consequences extend beyond simple account creation. A successful exploit grants the attacker control over the core identity infrastructure, which can potentially provide unauthorized access to HTTP and Dogtag certificate services in environments that employ Windows-style security identifiers.

Next Steps for Administrators

Administrators are urged to update their FreeIPA installations to the latest patched versions to close the unauthenticated write gap. Security teams should verify that their 389 Directory Server configurations are updated to correct the ownership validation logic. While the primary vulnerabilities have been identified and assigned CVEs, organizations should audit their LDAP access logs for any unauthorized token entries or unexpected administrator account creations that may have occurred prior to patching.