RHSA-2026:72279CriticalCVSS 9.8

Red Hat Security Advisory: ipa security, bug fix, and enhancement update

Published
September 28, 2026
Last Modified
October 14, 2026

🔗 CVE IDs covered (8)

CVE-2026-79678 →CVE-2026-11861 →CVE-2026-13097 →CVE-2026-18147 →CVE-2026-19550 →CVE-2026-73197 →CVE-2026-73198 →CVE-2026-76578 →

📋 Description

CVE-2026-11861 — FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships CVE-2026-13097 — ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore CVE-2026-18147 — freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL CVE-2026-19550 — freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes CVE-2026-73197 — ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read CVE-2026-73198 — ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request Body Read CVE-2026-76578 — ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI CVE-2026-79678 — freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

🎯 Affected products62

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • ipa-0:4.13.4-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-0:4.13.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-0:4.13.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-0:4.13.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-0:4.13.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-common-0:4.13.4-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-debuginfo-0:4.13.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-debuginfo-0:4.13.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-debuginfo-0:4.13.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-debuginfo-0:4.13.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-encrypted-dns-0:4.13.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-encrypted-dns-0:4.13.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-encrypted-dns-0:4.13.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-encrypted-dns-0:4.13.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-epn-0:4.13.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-epn-0:4.13.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-epn-0:4.13.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-epn-0:4.13.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-samba-0:4.13.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-samba-0:4.13.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-samba-0:4.13.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-client-samba-0:4.13.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-common-0:4.13.4-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-debuginfo-0:4.13.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-debuginfo-0:4.13.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-debuginfo-0:4.13.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-debuginfo-0:4.13.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • ipa-debugsource-0:4.13.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +32 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Restrict network access to the FreeIPA/IdM Web UI to trusted networks only. This can be achieved by configuring firewall rules to limit access to the IdM server's web interface (typically port 443 for HTTPS) from specific IP addresses or subnets. For example, using `firewalld` on RHEL, you can add a rich rule to allow access only from trusted sources. Ensure that any firewall changes are persistent across reboots and that the firewall service is reloaded or restarted for changes to take effect, which may temporarily disrupt access to the IdM Web UI. Workaround: This issue is fixed upstream. Administrators should apply this fix once available for their platform. Until then, the previously suggested compensating control (restricting "System: Read Trust Information" so it is not granted to all authenticated users) remains a valid interim workaround, with the same caveat that doing so may affect SSSD subdomain support, which relies on that permission's default breadth. Workaround: If the `/ipa/migration` endpoint is not required, it can be disabled by commenting out or removing the `Alias /ipa/migration` and its corresponding `<Directory>` block in the Apache configuration file (e.g., `/etc/httpd/conf.d/ipa.conf`). Alternatively, to limit the size of request bodies processed by the `/ipa/migration` endpoint, add the `LimitRequestBody` directive within the `<Directory "/usr/share/ipa/migration">` block in your Apache configuration, setting a conservative limit such as 1 MiB (1048576 bytes): ```apache <Directory "/usr/share/ipa/migration"> LimitRequestBody 1048576 # ... other directives ... </Directory> ``` After modifying the Apache configuration, the `httpd` service must be reloaded or restarted for the changes to take effect. This may temporarily interrupt service. Workaround: To mitigate this issue, configure Apache to enforce a request-body limit for the `/ipa/i18n_messages` endpoint. This can be achieved by adding `LimitRequestBody` directive within the Apache configuration for IPA. For example, to limit the request body to 1MB, add `LimitRequestBody 1048576` to the relevant `<Location "/ipa/i18n_messages">` block or a broader `/ipa/*` location. A restart of the Apache HTTP Server (`httpd`) service is required for the changes to take effect, which may temporarily impact FreeIPA service availability. If a reverse proxy or load balancer is used, ensure it also enforces an equivalent body-size limit. Workaround: Until a fixed package is available, restrict network access to the LDAP service (typically ports 389/636) to trusted hosts only, using firewall rules or network segmentation. Disabling anonymous LDAP binds blocks this specific attack path, though administrators should confirm this does not break other required anonymous-bind functionality in their deployment before applying it. Workaround: There is no configuration-based mitigation that prevents an authenticated but unprivileged principal from reaching the affected code path; upgrading to a fixed package is required once available. Administrators of container-based deployments should verify that credentials supplied via the PASSWORD environment variable during initial container setup do not persist in the running server process's environment.

🔗 References (12)