FreeIPA CVE-2026-76578 (Critical, Red Hat): anonymous LDAP client can gain administrator-group membership; fixed in FreeIPA 4.13.4
Red Hat's CVE-2026-76578 page rates the flaw Critical: a remote, unauthenticated LDAP client can abuse FreeIPA's self-managed-token ACI, together with a separately tracked flaw in 389 Directory Server's ACI evaluation, to create an attacker-chosen Kerberos principal and have it added to the administrators group, giving genuine FreeIPA administrator-group membership and administrative operations against the directory.
The FreeIPA 4.13.4 release notes list CVE-2026-76578 among the security issues fixed. Until a fixed package is available, Red Hat advises restricting the LDAP service (typically ports 389/636) to trusted hosts; disabling anonymous LDAP binds blocks this specific attack path. (sources: Red Hat; FreeIPA)
Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Red Hat; FreeIPA)
- Product
- FreeIPA / 389 Directory Server (Red Hat identity domain)
- Versions
- Fixed in FreeIPA 4.13.4 (FreeIPA release notes); see Red Hat CVE-2026-76578 for RHEL package status
- Exploited in Australia?
- unknown
- Patch to
- Apply Red Hat FreeIPA and 389 Directory Server security updates; audit unexpected Kerberos principals and administrators-group membership; restrict anonymous LDAP binds