Bug 2487472 (CVE-2026-11861) - CVE-2026-11861 FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships
Summary: CVE-2026-11861 FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating c...
Keywords:
Status: NEW
Alias: CVE-2026-11861
Deadline: 2026-08-30
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2520170
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-10 11:50 UTC by OSIDB Bzimport
Modified: 2026-10-14 17:26 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:70564 0 None None None 2026-09-24 02:29:39 UTC
Red Hat Product Errata RHSA-2026:72279 0 None None None 2026-09-28 04:01:00 UTC
Red Hat Product Errata RHSA-2026:82935 0 None None None 2026-10-14 14:44:23 UTC
Red Hat Product Errata RHSA-2026:83083 0 None None None 2026-10-14 17:26:48 UTC
Red Hat Product Errata RHSA-2026:83084 0 None None None 2026-10-14 17:26:24 UTC
Red Hat Product Errata RHSA-2026:83085 0 None None None 2026-10-14 17:26:10 UTC

Description OSIDB Bzimport 2026-06-10 11:50:40 UTC 
If trust relationship between FreeIPA and Active Directory is configured (established/created), AD users can bypass authentication of the FreeIPA portal, SMB server, LDAP directory and, presumably, any other GSSAPI services unauthorized, using impersonation in TGS, under certain conditions. In the worst case scenario a user could escalate their priveleges (permissions/rights) in FreeIPA domain. This is due to the fact that the portal, like other GSSAPI services, is not configured to verify PAC certificates and trusts the TGS cname field.
Comment 3 Jon Orris 2026-09-24 02:29:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:70564 https://access.redhat.com/errata/RHSA-2026:70564
Comment 4 Jon Orris 2026-09-28 04:00:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:72279 https://access.redhat.com/errata/RHSA-2026:72279
Comment 7 Jon Orris 2026-10-14 14:44:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:82935 https://access.redhat.com/errata/RHSA-2026:82935
Comment 8 Jon Orris 2026-10-14 17:26:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:83085 https://access.redhat.com/errata/RHSA-2026:83085
Comment 9 Jon Orris 2026-10-14 17:26:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:83084 https://access.redhat.com/errata/RHSA-2026:83084
Comment 10 Jon Orris 2026-10-14 17:26:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:83083 https://access.redhat.com/errata/RHSA-2026:83083
Note You need to log in before you can comment on or make changes to this bug.