CVE-2026-19550: Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes
A flaw was found in FreeIPA. The trust-fetch-domains command, used to refresh Active Directory trust topology, is gated only by the read-level ACI on the trust object (System: Read Trust Information, granted to any authenticated IPA user by default) rather than a trust-administration-level permission. Any authenticated, non-privileged IPA user can therefore invoke ipa trust-fetch-domains, which calls a root-owned oddjobd/D-Bus helper (install/oddjob/com.redhat.idm.trust-fetch-domains.in). When the caller supplies --admin/--password, the helper calls kinitpassword() against a caller-chosen --server using attacker-supplied credentials, with no cross-check that they belong to the real trusted AD forest, then accepts whatever forest-trust topology (domain names, NetBIOS names, SIDs) that attacker-controlled server returns via ipaserver/dcerpc.py's fetchdomains()/discovertrustinstance(). This fabricated data is written directly into the IPA LDAP directory as authoritative trust/ID-range topology by trust.addnewdomainsfromtrust(). The authorization gap itself (an unprivileged, non-admin user's request reaching the root-owned helper's execution with no ACI rejection) was reproduced dynamically in an isolated sandbox against ipa-server-4.13.5, confirmed against a negative control (an unrelated admin-only operation was correctly rejected in the same session). The exploiting principal holds zero delegated privilege — this is not a case of a narrow administrative delegation being used beyond its intended scope.
Other sources
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19550?
CVE-2026-19550 has a medium severity rating of 4.3.
How do I fix CVE-2026-19550?
To mitigate CVE-2026-19550, ensure that only privileged users have the necessary permissions to execute the trust-fetch-domains command.
What vulnerabilities are associated with CVE-2026-19550?
CVE-2026-19550 allows authenticated non-privileged users to perform unauthorized LDAP writes and trigger privileged Active Directory trust refreshes.
Who is affected by CVE-2026-19550?
Authenticated non-privileged FreeIPA users are affected by CVE-2026-19550 due to improper permission checks.
What is the impact of CVE-2026-19550?
The impact of CVE-2026-19550 includes potential unauthorized modifications to Active Directory trusts which could compromise directory security.