A critical security flaw has been identified in FreeIPA, enabling anonymous users to create Kerberos identities and add themselves to the administrators group. FreeIPA, a system that controls login access across Linux domains, utilizes a 389 Directory Server database accessed via LDAP. The issue arises from a second flaw in the directory server software, which allows the exploitation of access control rules. Red Hat, the organization responsible for FreeIPA, has already addressed this vulnerability in version 4.13.4. The flaw, tracked as CVE-2026-76578, received a critical severity rating from Red Hat with a preliminary CVSS score of 9.8.

The exploit becomes possible due to a default rule in 389 Directory Server, which erroneously permits an anonymous client to create a token entry with blank ownership fields. This allows the client to pass ownership checks and write a Kerberos identity and password alongside it. Red Hat has given this directory server flaw, CVE-2026-76560, a severity rating of 7.5. Although this rule is not enabled by default in Red Hat Directory Server, it is present in FreeIPA deployments, making them vulnerable.

Additionally, another vulnerability, CVE-2026-79678, affects the idp-add command in FreeIPA, allowing any server account to exploit it. This flaw, rated 8.1 in severity, involves passing user-supplied values into a Python eval() call, which could potentially expose server environment variables if passwords persist after setup. Red Hat has provided temporary mitigation steps for the chain flaw but advises that a fixed package is necessary for complete resolution. Red Hat credits Gia Bui from Calif and Anthropic for identifying these vulnerabilities.