Upgrading FreeIPA to 4.13.4 is now urgent: Red Hat demonstrated that a client which has never authenticated can forge its way into the administrators group. The vendor reproduced the two-bug chain twice on default installations, most recently on a machine with no network access at all.
FreeIPA handles who may log in and what they may reach across Linux domains, keeping its directory in a 389 Database Server store that clients access over LDAP. Red Hat has assigned the chain a preliminary CVSS score of 9.8 under CVE-2026-76578, while the directory-server bug alone rates 7.5 as CVE-2026-76560.
The story begins with a convenience FreeIPA grants by default: any user may administer their own one-time-password token. Nothing about that rule demands a prior login, and nothing stops extra fields from being written in the same operation. The second ingredient lives in 389 Directory Server, whose rule for restricting an entry to its authenticated owner compares a client name against a stored value as plain text.
Nobody, in the literal sense, passes that ownership test: a caller that has not authenticated carries an empty name, and an empty name equals an empty stored value. With ownership fields left blank, the entry clears the check, leaving the client free to attach a chosen Kerberos identity and password. Attackers first tried impersonating a real admin, a route closed by the CVE-2026-13097 fix, so they now simply pick their own name. A separate flaw, CVE-2026-79678 at 8.1, leaks process environment variables through the idp-add command’s error output, mainly a hazard for container installs that pass passwords as environment variables. Red Hat has seen no signs of in-the-wild exploitation.
