Fedora Account System
Red Hat Associate
Red Hat Customer
An unauthenticated LDAP client (anonymous bind or SASL ANONYMOUS) can create a self-managed OTP token entry with empty ipaTokenOwner/managedBy attributes, which satisfy 389 Directory Server's SELFDN ACI evaluator against the anonymous bind's own empty DN (see companion 389-ds flaw for that underlying defect). FreeIPA's self-managed-token ACI (install/share/default-aci.ldif) does not restrict which other attributes may be added, allowing the client to inject a Kerberos principal and password. Combined with a canonical-principal mismatch and, on older releases, a password-expiration-bypass, this produces genuine, reusable FreeIPA administrator Kerberos credentials. On SID-enabled deployments, the anonymously-readable ipaNTSecurityIdentifier attribute lets the attacker also obtain a PAC-bearing TGT, extending access to HTTP/Dogtag. Independently reproduced twice against a stock, unmodified freeipa/freeipa-server:almalinux-10 (FreeIPA 4.13.1) install — most recently from a client with zero prior access (no ticket, no local presence, network reachability only). Verified beyond the PoC's own output via klist -f, ldapwhoami -Y GSSAPI (returned genuine admin DN), ldapcompare (confirmed cn=admins membership), and a real admin-only write/delete (ipa user-add / ipa user-del). Reported by Gia Bui (Calif.io) via PSIRTSUPT-21812; see linked ticket for full technical writeup, reporter PoC, and reproduction logs.
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:70564 https://access.redhat.com/errata/RHSA-2026:70564
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:72279 https://access.redhat.com/errata/RHSA-2026:72279
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:82935 https://access.redhat.com/errata/RHSA-2026:82935
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:83085 https://access.redhat.com/errata/RHSA-2026:83085
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:83084 https://access.redhat.com/errata/RHSA-2026:83084
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:83083 https://access.redhat.com/errata/RHSA-2026:83083
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:83461 https://access.redhat.com/errata/RHSA-2026:83461
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:83460 https://access.redhat.com/errata/RHSA-2026:83460
(In reply to Jon Orris from comment #10) > This issue has been addressed in the following products: > > Red Hat Enterprise Linux 8 > > Via RHSA-2026:83460 https://access.redhat.com/errata/RHSA-2026:83460 https://geometrydashbreeze.com Yess
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:89836 https://access.redhat.com/errata/RHSA-2026:89836
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:93071 https://access.redhat.com/errata/RHSA-2026:93071
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:93452 https://access.redhat.com/errata/RHSA-2026:93452