Bug 2554719

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

An unauthenticated LDAP client (anonymous bind or SASL ANONYMOUS) can create a self-managed OTP token entry with empty ipaTokenOwner/managedBy attributes, which satisfy 389 Directory Server's SELFDN ACI evaluator against the anonymous bind's own empty DN (see companion 389-ds flaw for that underlying defect). FreeIPA's self-managed-token ACI (install/share/default-aci.ldif) does not restrict which other attributes may be added, allowing the client to inject an arbitrary attacker-chosen Kerberos principal and password.

The originally reported technique forged the literal admin@REALM principal via a canonical-name collision with the existing admin account. A prior fix (CVE-2026-13097) now blocks that specific collision: live re-testing on a patched instance shows the LDAP ADD is rejected (err=19, constraint violation) once all rotated canonical spellings collide with the existing admin entry. This does not fix the underlying anonymous-write defect, only the admin-name-collision special case.

The attack reformulates trivially: the same anonymous bypass creates a new, non-colliding Kerberos principal (not named admin, so no collision occurs), and that new principal is then added to cn=admins,cn=groups,cn=accounts,$SUFFIX -- independently verified by the FreeIPA maintainer team to still succeed, since the vulnerable ACI does not otherwise restrict group-membership changes reachable from the same anonymous foothold. The end state is unchanged: an unauthenticated attacker obtains a Kerberos principal that is a genuine member of the administrators group, i.e. real FreeIPA administrative privileges, under an attacker-chosen name rather than literally 'admin'. On SID-enabled deployments, the anonymously-readable ipaNTSecurityIdentifier attribute lets the attacker also obtain a PAC-bearing TGT, extending access to HTTP/Dogtag.

Independently reproduced twice by Red Hat against a stock, unmodified freeipa/freeipa-server:almalinux-10 (FreeIPA 4.13.1) install using the original admin-name-collision technique, most recently from a client with zero prior access (no ticket, no local presence, network reachability only), and verified beyond the PoC's own output via klist -f, ldapwhoami -Y GSSAPI, ldapcompare (cn=admins membership), and a real admin-only write/delete (ipa user-add / ipa user-del). The reformulated create-new-principal-then-add-to-admins variant has been verified by the FreeIPA maintainer team but not yet independently reproduced by Red Hat; that reproduction is still pending.