CVE-2026-76578: Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
Other sources
An unauthenticated LDAP client (anonymous bind or SASL ANONYMOUS) can create a self-managed OTP token entry with empty ipaTokenOwner/managedBy attributes, which satisfy 389 Directory Server's SELFDN ACI evaluator against the anonymous bind's own empty DN (see companion 389-ds flaw for that underlying defect). FreeIPA's self-managed-token ACI (install/share/default-aci.ldif) does not restrict which other attributes may be added, allowing the client to inject a Kerberos principal and password. Combined with a canonical-principal mismatch and, on older releases, a password-expiration-bypass, this produces genuine, reusable FreeIPA administrator Kerberos credentials. On SID-enabled deployments, the anonymously-readable ipaNTSecurityIdentifier attribute lets the attacker also obtain a PAC-bearing TGT, extending access to HTTP/Dogtag.
Independently reproduced twice against a stock, unmodified freeipa/freeipa-server:almalinux-10 (FreeIPA 4.13.1) install — most recently from a client with zero prior access (no ticket, no local presence, network reachability only). Verified beyond the PoC's own output via klist -f, ldapwhoami -Y GSSAPI (returned genuine admin DN), ldapcompare (confirmed cn=admins membership), and a real admin-only write/delete (ipa user-add / ipa user-del).
Reported by Gia Bui (Calif.io) via PSIRTSUPT-21812; see linked ticket for full technical writeup, reporter PoC, and reproduction logs.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Isolate FreeIPA from untrusted networks so that an unauthenticated LDAP client cannot reach the LDAP service (e.g., restrict inbound LDAP/LDAPS access to known management sources only).
- Compensating control
Restrict access to the Dogtag/IdM services that rely on SID-enabled deployments (so that stolen/created administrator credentials cannot be used to extend access beyond FreeIPA) by limiting network reachability to those services to trusted sources only.