RHSA-2026:70564
Vulnerability from csaf_redhat - Published: 2026-09-24 03:24 - Updated: 2026-09-24 09:38Summary
Red Hat Security Advisory: ipa security, bug fix, and enhancement update
Severity
Critical
Notes
Topic: An update for ipa is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.
Security Fix(es):
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198)
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197)
* FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)
* freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)
* freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)
* ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
* ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)
* freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)
Bug Fix(es) and Enhancement(s):
* [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL9.8] (JIRA:RHEL-170987)
* WebUI Hardening [rhel-9.8.z] (JIRA:RHEL-238511)
* ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:RHEL-238519)
* host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z] (JIRA:RHEL-238523)
* ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:RHEL-238527)
* ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:RHEL-238674)
* ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:RHEL-238677)
* ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z] (JIRA:RHEL-240767)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.
9.6 (Critical)
Affected products
Fixed
60 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.
8.7 (High)
Affected products
Fixed
60 products, the same list as for
CVE-2026-11861
Threats
Impact
Important
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.
8.1 (High)
Affected products
Fixed
60 products, the same list as for
CVE-2026-11861
Threats
Impact
Important
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
8.2 (High)
Affected products
Fixed
60 products, the same list as for
CVE-2026-11861
Threats
Impact
Important
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
7.5 (High)
Affected products
Fixed
60 products, the same list as for
CVE-2026-11861
Threats
Impact
Important
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.
7.5 (High)
Affected products
Fixed
60 products, the same list as for
CVE-2026-11861
Threats
Impact
Important
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
9.8 (Critical)
Affected products
Fixed
60 products, the same list as for
CVE-2026-11861
Threats
Impact
Critical
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.
8.1 (High)
Affected products
Fixed
60 products, the same list as for
CVE-2026-11861
Threats
Impact
Important
References
44 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ipa is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.\n\nSecurity Fix(es):\n\n* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198)\n\n* ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197)\n\n* FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)\n\n* freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)\n\n* freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)\n\n* ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)\n\n* ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)\n\n* freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)\n\nBug Fix(es) and Enhancement(s):\n\n* [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL9.8] (JIRA:RHEL-170987)\n\n* WebUI Hardening [rhel-9.8.z] (JIRA:RHEL-238511)\n\n* ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:RHEL-238519)\n\n* host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z] (JIRA:RHEL-238523)\n\n* ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:RHEL-238527)\n\n* ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:RHEL-238674)\n\n* ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:RHEL-238677)\n\n* ipa-migrate tool is renaming host records \u0026 host info in automount information [rhel-9.8.z] (JIRA:RHEL-240767)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:70564",
"url": "https://access.redhat.com/errata/RHSA-2026:70564"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "2472960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2472960"
},
{
"category": "external",
"summary": "2474697",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2474697"
},
{
"category": "external",
"summary": "2487472",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487472"
},
{
"category": "external",
"summary": "2508181",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508181"
},
{
"category": "external",
"summary": "2514019",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514019"
},
{
"category": "external",
"summary": "2515974",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515974"
},
{
"category": "external",
"summary": "2519522",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519522"
},
{
"category": "external",
"summary": "2523356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523356"
},
{
"category": "external",
"summary": "RHEL-170987",
"url": "https://issues.redhat.com/browse/RHEL-170987"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70564.json"
}
],
"title": "Red Hat Security Advisory: ipa security, bug fix, and enhancement update",
"tracking": {
"current_release_date": "2026-09-24T09:38:05+00:00",
"generator": {
"date": "2026-09-24T09:38:05+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:70564",
"initial_release_date": "2026-09-24T03:24:23+00:00",
"revision_history": [
{
"date": "2026-09-24T03:24:23+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-24T03:24:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-24T09:38:05+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::crb"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "python3-ipatests-0:4.13.4-1.el9_8.noarch",
"product": {
"name": "python3-ipatests-0:4.13.4-1.el9_8.noarch",
"product_id": "python3-ipatests-0:4.13.4-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-ipatests@4.13.4-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ipa-client-common-0:4.13.4-1.el9_8.noarch",
"product": {
"name": "ipa-client-common-0:4.13.4-1.el9_8.noarch",
"product_id": "ipa-client-common-0:4.13.4-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-common@4.13.4-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ipa-common-0:4.13.4-1.el9_8.noarch",
"product": {
"name": "ipa-common-0:4.13.4-1.el9_8.noarch",
"product_id": "ipa-common-0:4.13.4-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-common@4.13.4-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ipa-selinux-0:4.13.4-1.el9_8.noarch",
"product": {
"name": "ipa-selinux-0:4.13.4-1.el9_8.noarch",
"product_id": "ipa-selinux-0:4.13.4-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-selinux@4.13.4-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"product": {
"name": "ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"product_id": "ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-selinux-luna@4.13.4-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"product": {
"name": "ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"product_id": "ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-selinux-nfast@4.13.4-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ipa-server-common-0:4.13.4-1.el9_8.noarch",
"product": {
"name": "ipa-server-common-0:4.13.4-1.el9_8.noarch",
"product_id": "ipa-server-common-0:4.13.4-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-common@4.13.4-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"product": {
"name": "ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"product_id": "ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-dns@4.13.4-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"product": {
"name": "python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"product_id": "python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-ipaclient@4.13.4-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3-ipalib-0:4.13.4-1.el9_8.noarch",
"product": {
"name": "python3-ipalib-0:4.13.4-1.el9_8.noarch",
"product_id": "python3-ipalib-0:4.13.4-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-ipalib@4.13.4-1.el9_8?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"product": {
"name": "python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"product_id": "python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-ipaserver@4.13.4-1.el9_8?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ipa-0:4.13.4-1.el9_8.src",
"product": {
"name": "ipa-0:4.13.4-1.el9_8.src",
"product_id": "ipa-0:4.13.4-1.el9_8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa@4.13.4-1.el9_8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ipa-client-0:4.13.4-1.el9_8.x86_64",
"product": {
"name": "ipa-client-0:4.13.4-1.el9_8.x86_64",
"product_id": "ipa-client-0:4.13.4-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client@4.13.4-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"product": {
"name": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"product_id": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-encrypted-dns@4.13.4-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"product": {
"name": "ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"product_id": "ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-epn@4.13.4-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"product": {
"name": "ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"product_id": "ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-samba@4.13.4-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ipa-server-0:4.13.4-1.el9_8.x86_64",
"product": {
"name": "ipa-server-0:4.13.4-1.el9_8.x86_64",
"product_id": "ipa-server-0:4.13.4-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server@4.13.4-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"product": {
"name": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"product_id": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-encrypted-dns@4.13.4-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"product": {
"name": "ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"product_id": "ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-trust-ad@4.13.4-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"product": {
"name": "ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"product_id": "ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-debugsource@4.13.4-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"product": {
"name": "ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"product_id": "ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-debuginfo@4.13.4-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"product": {
"name": "ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"product_id": "ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-debuginfo@4.13.4-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"product": {
"name": "ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"product_id": "ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-debuginfo@4.13.4-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"product": {
"name": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"product_id": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-trust-ad-debuginfo@4.13.4-1.el9_8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ipa-client-0:4.13.4-1.el9_8.aarch64",
"product": {
"name": "ipa-client-0:4.13.4-1.el9_8.aarch64",
"product_id": "ipa-client-0:4.13.4-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client@4.13.4-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"product": {
"name": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"product_id": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-encrypted-dns@4.13.4-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"product": {
"name": "ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"product_id": "ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-epn@4.13.4-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"product": {
"name": "ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"product_id": "ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-samba@4.13.4-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ipa-server-0:4.13.4-1.el9_8.aarch64",
"product": {
"name": "ipa-server-0:4.13.4-1.el9_8.aarch64",
"product_id": "ipa-server-0:4.13.4-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server@4.13.4-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"product": {
"name": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"product_id": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-encrypted-dns@4.13.4-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"product": {
"name": "ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"product_id": "ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-trust-ad@4.13.4-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"product": {
"name": "ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"product_id": "ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-debugsource@4.13.4-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"product": {
"name": "ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"product_id": "ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-debuginfo@4.13.4-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"product": {
"name": "ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"product_id": "ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-debuginfo@4.13.4-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"product": {
"name": "ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"product_id": "ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-debuginfo@4.13.4-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"product": {
"name": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"product_id": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-trust-ad-debuginfo@4.13.4-1.el9_8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "ipa-client-0:4.13.4-1.el9_8.ppc64le",
"product": {
"name": "ipa-client-0:4.13.4-1.el9_8.ppc64le",
"product_id": "ipa-client-0:4.13.4-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client@4.13.4-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"product": {
"name": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"product_id": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-encrypted-dns@4.13.4-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"product": {
"name": "ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"product_id": "ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-epn@4.13.4-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"product": {
"name": "ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"product_id": "ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-samba@4.13.4-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ipa-server-0:4.13.4-1.el9_8.ppc64le",
"product": {
"name": "ipa-server-0:4.13.4-1.el9_8.ppc64le",
"product_id": "ipa-server-0:4.13.4-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server@4.13.4-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"product": {
"name": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"product_id": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-encrypted-dns@4.13.4-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"product": {
"name": "ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"product_id": "ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-trust-ad@4.13.4-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"product": {
"name": "ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"product_id": "ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-debugsource@4.13.4-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"product": {
"name": "ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"product_id": "ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-debuginfo@4.13.4-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"product": {
"name": "ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"product_id": "ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-debuginfo@4.13.4-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"product": {
"name": "ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"product_id": "ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-debuginfo@4.13.4-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"product": {
"name": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"product_id": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-trust-ad-debuginfo@4.13.4-1.el9_8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "ipa-client-0:4.13.4-1.el9_8.s390x",
"product": {
"name": "ipa-client-0:4.13.4-1.el9_8.s390x",
"product_id": "ipa-client-0:4.13.4-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client@4.13.4-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"product": {
"name": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"product_id": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-encrypted-dns@4.13.4-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"product": {
"name": "ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"product_id": "ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-epn@4.13.4-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"product": {
"name": "ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"product_id": "ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-samba@4.13.4-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ipa-server-0:4.13.4-1.el9_8.s390x",
"product": {
"name": "ipa-server-0:4.13.4-1.el9_8.s390x",
"product_id": "ipa-server-0:4.13.4-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server@4.13.4-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"product": {
"name": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"product_id": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-encrypted-dns@4.13.4-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"product": {
"name": "ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"product_id": "ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-trust-ad@4.13.4-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"product": {
"name": "ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"product_id": "ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-debugsource@4.13.4-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"product": {
"name": "ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"product_id": "ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-client-debuginfo@4.13.4-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"product": {
"name": "ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"product_id": "ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-debuginfo@4.13.4-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"product": {
"name": "ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"product_id": "ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-debuginfo@4.13.4-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"product": {
"name": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"product_id": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ipa-server-trust-ad-debuginfo@4.13.4-1.el9_8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-0:4.13.4-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src"
},
"product_reference": "ipa-0:4.13.4-1.el9_8.src",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-0:4.13.4-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64"
},
"product_reference": "ipa-client-0:4.13.4-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-0:4.13.4-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le"
},
"product_reference": "ipa-client-0:4.13.4-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-0:4.13.4-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x"
},
"product_reference": "ipa-client-0:4.13.4-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-0:4.13.4-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64"
},
"product_reference": "ipa-client-0:4.13.4-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-common-0:4.13.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch"
},
"product_reference": "ipa-client-common-0:4.13.4-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64"
},
"product_reference": "ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le"
},
"product_reference": "ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x"
},
"product_reference": "ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64"
},
"product_reference": "ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64"
},
"product_reference": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le"
},
"product_reference": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x"
},
"product_reference": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64"
},
"product_reference": "ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-epn-0:4.13.4-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64"
},
"product_reference": "ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-epn-0:4.13.4-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le"
},
"product_reference": "ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-epn-0:4.13.4-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x"
},
"product_reference": "ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-epn-0:4.13.4-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64"
},
"product_reference": "ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-samba-0:4.13.4-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64"
},
"product_reference": "ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-samba-0:4.13.4-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le"
},
"product_reference": "ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-samba-0:4.13.4-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x"
},
"product_reference": "ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-client-samba-0:4.13.4-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64"
},
"product_reference": "ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-common-0:4.13.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch"
},
"product_reference": "ipa-common-0:4.13.4-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-debuginfo-0:4.13.4-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64"
},
"product_reference": "ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le"
},
"product_reference": "ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-debuginfo-0:4.13.4-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x"
},
"product_reference": "ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-debuginfo-0:4.13.4-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64"
},
"product_reference": "ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-debugsource-0:4.13.4-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64"
},
"product_reference": "ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-debugsource-0:4.13.4-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le"
},
"product_reference": "ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-debugsource-0:4.13.4-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x"
},
"product_reference": "ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-debugsource-0:4.13.4-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64"
},
"product_reference": "ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-selinux-0:4.13.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch"
},
"product_reference": "ipa-selinux-0:4.13.4-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-selinux-luna-0:4.13.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch"
},
"product_reference": "ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch"
},
"product_reference": "ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-0:4.13.4-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64"
},
"product_reference": "ipa-server-0:4.13.4-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-0:4.13.4-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le"
},
"product_reference": "ipa-server-0:4.13.4-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-0:4.13.4-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x"
},
"product_reference": "ipa-server-0:4.13.4-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-0:4.13.4-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64"
},
"product_reference": "ipa-server-0:4.13.4-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-common-0:4.13.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch"
},
"product_reference": "ipa-server-common-0:4.13.4-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64"
},
"product_reference": "ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le"
},
"product_reference": "ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x"
},
"product_reference": "ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64"
},
"product_reference": "ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-dns-0:4.13.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch"
},
"product_reference": "ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64"
},
"product_reference": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le"
},
"product_reference": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x"
},
"product_reference": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64"
},
"product_reference": "ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64"
},
"product_reference": "ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le"
},
"product_reference": "ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x"
},
"product_reference": "ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64"
},
"product_reference": "ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64"
},
"product_reference": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le"
},
"product_reference": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x"
},
"product_reference": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64"
},
"product_reference": "ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-ipaclient-0:4.13.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch"
},
"product_reference": "python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-ipalib-0:4.13.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch"
},
"product_reference": "python3-ipalib-0:4.13.4-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-ipaserver-0:4.13.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch"
},
"product_reference": "python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-ipatests-0:4.13.4-1.el9_8.noarch as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"product_id": "CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
},
"product_reference": "python3-ipatests-0:4.13.4-1.el9_8.noarch",
"relates_to_product_reference": "CRB-9.8.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Vladislav Plyatsok (rd01f)"
]
}
],
"cve": "CVE-2026-11861",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-06-10T11:24:37.998000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487472"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate because practical exploitation is significantly constrained by conditions that are unlikely to be met in most production environments. The attack requires a cross-realm trust to be configured between FreeIPA and Active Directory, the attacker must already hold a valid Active Directory account, and the impersonation technique depends on the ability to register a duplicate or conflicting Service Principal Name (SPN) in the Active Directory forest. Microsoft addressed this prerequisite by enforcing SPN and UPN uniqueness constraints on Windows Server 2012 R2 domain controllers with MSKB-3070083 applied, and by default on Windows 11 version 22H2 and later. In environments where the Active Directory domain controllers are patched and running a supported functional level, the attack path is blocked on the Windows side. Only deployments trusting an outdated or unpatched Active Directory environment remain realistically at risk, making this primarily a theoretical concern in modern, maintained environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11861"
},
{
"category": "external",
"summary": "RHBZ#2487472",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487472"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11861",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11861"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11861",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11861"
}
],
"release_date": "2026-08-20T08:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T03:24:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70564"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships"
},
{
"acknowledgments": [
{
"names": [
"Vladislav Plyatsok (rd01f)"
]
}
],
"cve": "CVE-2026-13097",
"cwe": {
"id": "CWE-706",
"name": "Use of Incorrectly-Resolved Name or Reference"
},
"discovery_date": "2026-08-14T11:24:55.091000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515974"
}
],
"notes": [
{
"category": "description",
"text": "A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This bug can only be used if the user already has access to the LDAP to a computer account or an account with the right to add to almost any branch of the LDAP directory. Also this bug can be used to corrupt the LDAP privileges but can not be used to launch a Denial of Service since LDAP privileges do not generally coincide with system privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13097"
},
{
"category": "external",
"summary": "RHBZ#2515974",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515974"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13097",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13097"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13097",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13097"
}
],
"release_date": "2026-08-20T10:19:07.922000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T03:24:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70564"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore"
},
{
"acknowledgments": [
{
"names": [
"Todd Cullum"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-18147",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-07-28T19:01:51.606000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2508181"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim\u0027s authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the FreeIPA/IdM Web UI password reset page, allowing an unauthenticated remote attacker to execute arbitrary JavaScript. Exploitation requires a victim to click a crafted link and complete the password reset, potentially leading to full IdM administrative compromise if an administrator is targeted. This poses a significant risk to identity management infrastructure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18147"
},
{
"category": "external",
"summary": "RHBZ#2508181",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508181"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18147"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18147",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18147"
}
],
"release_date": "2026-09-09T14:19:26.355000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T03:24:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70564"
},
{
"category": "workaround",
"details": "Restrict network access to the FreeIPA/IdM Web UI to trusted networks only. This can be achieved by configuring firewall rules to limit access to the IdM server\u0027s web interface (typically port 443 for HTTPS) from specific IP addresses or subnets. For example, using `firewalld` on RHEL, you can add a rich rule to allow access only from trusted sources. Ensure that any firewall changes are persistent across reboots and that the firewall service is reloaded or restarted for changes to take effect, which may temporarily disrupt access to the IdM Web UI.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL"
},
{
"acknowledgments": [
{
"names": [
"Andrew Rukin"
],
"organization": "Arenadata"
}
],
"cve": "CVE-2026-19550",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"discovery_date": "2026-08-06T09:11:12+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514019"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw only affects Identity Management (IdM/FreeIPA) servers where a cross-forest trust with Active \nDirectory has been established (via ipa-adtrust-install and ipa trust-add). Servers without an active AD trust\nare not affected, since the trust object and the ADTRUST component required to reach the vulnerable code path\ndo not exist in that configuration.\n\nExploitation requires an ordinary, non-administrative IdM user account to trigger the vulnerable \ntrust-fetch-domains command against a server of the attacker\u0027s choosing \u2014 no delegated administrative \nprivilege of any kind is required. On its own, this lets an authenticated non-admin user force the IdM server \nto launch a privileged helper process and initiate a network connection to attacker-controlled infrastructure.\n\nImpersonating accounts in the trusted Active Directory domain \u2014 additionally \nrequires the attacker to intercept and relay the resulting Kerberos authentication traffic, force a downgrade \nto the weaker encrypted-timestamp pre-authentication mechanism, and successfully recover the trust\u0027s \ninterrealm secret through that downgrade.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19550"
},
{
"category": "external",
"summary": "RHBZ#2514019",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514019"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19550"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19550",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19550"
}
],
"release_date": "2026-08-11T15:04:44+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T03:24:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70564"
},
{
"category": "workaround",
"details": "This issue is fixed upstream. Administrators should apply this fix once available for their platform. Until then, the previously suggested compensating control (restricting \"System: Read Trust Information\" so it is not granted to all authenticated users) remains a valid interim workaround, with the same caveat that doing so may affect SSSD subdomain support, which relies on that permission\u0027s default breadth.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes"
},
{
"acknowledgments": [
{
"names": [
"AISLE Research"
]
}
],
"cve": "CVE-2026-73197",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-11T20:27:44+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2474697"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73197"
},
{
"category": "external",
"summary": "RHBZ#2474697",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2474697"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73197"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73197",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73197"
}
],
"release_date": "2026-08-20T10:05:49.171000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T03:24:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70564"
},
{
"category": "workaround",
"details": "If the `/ipa/migration` endpoint is not required, it can be disabled by commenting out or removing the `Alias /ipa/migration` and its corresponding `\u003cDirectory\u003e` block in the Apache configuration file (e.g., `/etc/httpd/conf.d/ipa.conf`).\n\nAlternatively, to limit the size of request bodies processed by the `/ipa/migration` endpoint, add the `LimitRequestBody` directive within the `\u003cDirectory \"/usr/share/ipa/migration\"\u003e` block in your Apache configuration, setting a conservative limit such as 1 MiB (1048576 bytes):\n\n```apache\n\u003cDirectory \"/usr/share/ipa/migration\"\u003e\n LimitRequestBody 1048576\n # ... other directives ...\n\u003c/Directory\u003e\n```\n\nAfter modifying the Apache configuration, the `httpd` service must be reloaded or restarted for the changes to take effect. This may temporarily interrupt service.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-73198",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-11T20:27:44+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2472960"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73198"
},
{
"category": "external",
"summary": "RHBZ#2472960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2472960"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73198"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73198",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73198"
}
],
"release_date": "2026-08-20T10:12:23.072000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T03:24:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70564"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure Apache to enforce a request-body limit for the `/ipa/i18n_messages` endpoint. This can be achieved by adding `LimitRequestBody` directive within the Apache configuration for IPA. For example, to limit the request body to 1MB, add `LimitRequestBody 1048576` to the relevant `\u003cLocation \"/ipa/i18n_messages\"\u003e` block or a broader `/ipa/*` location. A restart of the Apache HTTP Server (`httpd`) service is required for the changes to take effect, which may temporarily impact FreeIPA service availability. If a reverse proxy or load balancer is used, ensure it also enforces an equivalent body-size limit.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read"
},
{
"acknowledgments": [
{
"names": [
"Gia Bui (yabeow)"
],
"organization": "Calif.io"
}
],
"cve": "CVE-2026-76578",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-08-15T16:11:15+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519522"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server\u0027s ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a Critical flaw allowing complete, unauthenticated compromise of a FreeIPA/IdM server\u0027s administrative privileges. The technique originally disclosed impersonated the literal admin account via a canonical-name collision; a separate prior fix (CVE-2026-13097) now blocks that specific collision but does not address the underlying unauthenticated write access. The attack still succeeds by having the anonymously-created principal added to the administrators group under an attacker-chosen name, reaching the same practical outcome. Exploitation of the original collision-based technique has been independently confirmed by Red Hat against a default, unmodified FreeIPA installation and requires no credentials, user interaction, or prior access, only network reachability to the LDAP service. Any FreeIPA/IdM deployment exposing LDAP to an untrusted network should be considered at immediate risk until patched.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-76578"
},
{
"category": "external",
"summary": "RHBZ#2519522",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519522"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-76578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76578"
}
],
"release_date": "2026-09-07T11:46:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T03:24:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70564"
},
{
"category": "workaround",
"details": "Until a fixed package is available, restrict network access to the LDAP service (typically ports 389/636) to trusted hosts only, using firewall rules or network segmentation. Disabling anonymous LDAP binds blocks this specific attack path, though administrators should confirm this does not break other required anonymous-bind functionality in their deployment before applying it.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI"
},
{
"acknowledgments": [
{
"names": [
"Calif.io"
],
"organization": "in collaboration with Anthropic"
}
],
"cve": "CVE-2026-79678",
"cwe": {
"id": "CWE-95",
"name": "Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)"
},
"discovery_date": "2026-08-15T11:25:41+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2523356"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in FreeIPA\u0027s idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw does not allow arbitrary code execution. The eval() call reachable through this flaw is constrained by a regular expression that forbids parentheses in the evaluated expression, which prevents invoking any function.\n\nThe severity of the confidentiality impact from this flaw depends on the deployment method. On a standard RPM-based Identity Management (IdM) installation, the affected server process\u0027s environment contains only non-sensitive, publicly documented path constants and configuration flags. In container-based deployments using the official FreeIPA server container image, where the Directory Manager and administrator passwords are commonly supplied via an environment variable at first boot, this flaw could expose those credentials if they remain present in the process environment after installation completes.\n\nThis flaw is rated Important rather than Critical because no code execution is possible, and rather than Moderate because the confirmed environment-disclosure and denial-of-service primitives are systematic and reliable, and are not dependent on non-default configuration to be triggered.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-79678"
},
{
"category": "external",
"summary": "RHBZ#2523356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-79678",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79678"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-79678",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79678"
}
],
"release_date": "2026-09-07T11:46:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-24T03:24:23+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:70564"
},
{
"category": "workaround",
"details": "There is no configuration-based mitigation that prevents an authenticated but unprivileged principal from reaching the affected code path; upgrading to a fixed package is required once available. Administrators of container-based deployments should verify that credentials supplied via the PASSWORD environment variable during initial container setup do not persist in the running server process\u0027s environment.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:ipa-0:4.13.4-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-epn-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-client-samba-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-debugsource-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-luna-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-selinux-nfast-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-common-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-dns-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-encrypted-dns-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:ipa-server-trust-ad-debuginfo-0:4.13.4-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaclient-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipalib-0:4.13.4-1.el9_8.noarch",
"AppStream-9.8.0.Z.MAIN.EUS:python3-ipaserver-0:4.13.4-1.el9_8.noarch",
"CRB-9.8.0.Z.MAIN.EUS:python3-ipatests-0:4.13.4-1.el9_8.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…