CVE-2026-79678: Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.
Other sources
A flaw was found in FreeIPA's idp-add command. ipapython.ipautil.templatestr() evaluates any 'eval(...)' token found in a post-substitution string using Python's eval(). ipaserver/plugins/idp.py passes the caller-supplied --organization and --base-url values (ipaidporg/ipaidpbaseurl), which have no input validation, into this function via provider templates (okta, keycloak, microsoft). The LDAPCreate command framework runs this evaluation inside precallback, before the LDAP access control check that restricts idp-add to the 'External IdP server Administrators' privilege is ever evaluated. As a result, any authenticated IPA principal, regardless of privilege level, can trigger this evaluation.
The regular expression that locates the eval(...) token forbids parentheses inside the evaluated expression, which prevents invoking any function and therefore prevents code execution. However, using parenthesis-free short-circuit boolean expressions, an attacker can distinguish, via the JSON-RPC error code returned by the server, whether a guessed condition is true, and combined with parenthesis-free star and dict-unpacking syntax, this allows systematic enumeration and extraction of the entire environment of the affected server process, with no prior knowledge of variable names required. Separately, a short expression exploiting Python's right-associative exponentiation operator reliably exhausts the affected process's available memory within seconds, providing a cheap, repeatable denial-of-service primitive.
Both primitives are reachable by any authenticated IPA principal, not only those holding the privilege the idp-add command is nominally restricted to.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the JSON-RPC endpoint(s) that permit invoking FreeIPA's `idp-add` (via the `LDAPCreate` command framework) so that only the 'External IdP server Administrators' privilege can reach the pre_callback evaluation path.
- Compensating control
Harden network/authorization so that any authenticated IPA principal cannot invoke the `idp-add` code path; ensure callers are authorized before the evaluation occurs in `LDAPCreate.pre_callback`.
- Operational
After remediation, assume the affected server process environment may have been disclosed and restarted/recovered as needed (e.g., rotate any secrets that may have been present in environment variables) to mitigate potential impact from environment enumeration.