Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

Summary

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

Timeline

1. Sep 7, 2026, 12:01 PM UTCCVE published
2. Sep 8, 2026, 1:58 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Oct 26, 2026, 1:27 PM UTCRecord last updated

Affected versions

• ipa

  Version range not reported

• ipa

  Version range not reported

• idm:client

  Version range not reported

• idm:DL1

  Version range not reported

• idm:client

  Version range not reported

• idm:DL1

  Version range not reported

• idm:client

  Version range not reported

• idm:DL1

  Version range not reported

• idm:client

  Version range not reported

• idm:DL1

  Version range not reported

• idm:client

  Version range not reported

• idm:DL1

  Version range not reported

• ipa

  Version range not reported

• ipa

  Version range not reported

• ipa

  Version range not reported

• ipa

  Version range not reported

• ipa

  Version range not reported

• ipa

  Version range not reported

• ipa

  Version range not reported

References 11