The FreeIPA project reports:
- CVE-2026-76578: the access control instruction for self-managed
OTP tokens requires no authentication and does not restrict which
attributes may be written alongside the token entry. An
unauthenticated LDAP client can create a Kerberos principal and
add it to the administrators group.
- CVE-2026-79678: insufficiently validated --organization and
--base-url input to idp-add reaches a constrained eval() before
the LDAP access control check is enforced, allowing any
authenticated principal to enumerate server environment variables
and to exhaust memory.
- CVE-2026-11861: where a cross-realm trust with Active Directory
is configured, Active Directory users can bypass authentication
for FreeIPA services including the Web UI, the SMB server and the
LDAP directory.
- CVE-2026-13097: the uniqueness constraint on Kerberos principal
name attributes does not account for equivalent representations of
the same name, so a user with LDAP write privileges can create a
service principal that impersonates a privileged one.
- CVE-2026-19550: trust-fetch-domains is gated by a read-only
permission on the trust object rather than a trust administration
permission, letting any authenticated user trigger a privileged
trust refresh against an attacker-supplied server.
- CVE-2026-73196: an oversized OTP key value is decoded and
re-encoded without a size limit, consuming excessive CPU and
memory.
- CVE-2026-73197: the migration endpoint reads oversized POST
bodies fully into memory, which an unauthenticated client can
abuse for denial of service.
- CVE-2026-73198: the i18n_messages endpoint accepts arbitrarily
large request bodies, which an unauthenticated client can abuse
for memory exhaustion.
- CVE-2026-73199: a null pointer dereference in the ipa-enrollment
SLAPI plugin crashes the directory server when a malformed LDAP
extended operation omits a required request value.