What happened
FreeIPA is an open-source system for centrally managing users, machines and logins on Linux networks. Red Hat ships it as Red Hat Identity Management (IdM), part of Red Hat Enterprise Linux (RHEL). A critical flaw, CVE-2026-76578, has been found in FreeIPA and was published in the NVD database on September 7, 2026.
According to the flaw description, an attacker who never logs in can get themselves into the FreeIPA administrators group. Red Hat rated the issue Critical and shipped fixes in stages: for RHEL 9 on September 23, 2026, for RHEL 10 on September 28, 2026, and for the extended support streams RHEL 9.6 EUS and RHEL 10.0 EUS on October 14, 2026.
The same updates fix other FreeIPA flaws as well. Red Hat lists among them two bugs that let an unauthenticated attacker knock the service offline, a cross-site scripting bug and several flaws that can lead to unauthorized directory changes or privilege escalation.
So far, neither Red Hat, the US agency CISA nor the EU vulnerability database EUVD run by ENISA has confirmed exploitation in the wild. EUVD lists the flaw as EUVD-2026-72356 with no exploitation recorded.
Why it is dangerous
This is a “Missing Authentication for Critical Function” flaw (CWE-306). FreeIPA stores its data in an LDAP directory, and access rules (ACIs) decide who may change what. According to the flaw description, the rule meant to let users manage their own one-time password (OTP) tokens does not require a login and does not limit which other attributes can be written along with the token.
Picture a drop box at the front desk where staff leave requests for a new access badge. Nobody checks who dropped the request in, or whether a “permit” for the server room key was slipped in with it. According to the description, an attacker who combines this with a related, separately tracked flaw in the underlying directory server can create a Kerberos account of their choosing and get it added to the administrators group.
No password or user interaction is needed, only network access to the LDAP service of a FreeIPA server. The attacker gains genuine administrator group membership and can perform administrative operations on the directory. On SID-enabled deployments (Windows-style identifiers, used for example with Active Directory trusts), they can also reach other IdM services. Whoever controls FreeIPA typically controls logins and permissions on every enrolled server.
- CVSS 9.8 out of 10: the score was assigned by Red Hat using CVSS 3.1. CVSS measures technical severity, and 9.8 is in the critical range.
- CISA KEV: a catalog of flaws the US agency CISA knows are being actively exploited. This flaw is not in it at the time of writing.
- EPSS 1.2%: the estimated probability of exploitation in the next 30 days as of November 1, 2026. That is higher than roughly 68% of all other vulnerabilities.
Who is affected
This affects organizations that use FreeIPA or Red Hat Identity Management to centrally manage users and logins. Typically that means company networks with Linux servers, where the IPA server acts as the Linux counterpart to Active Directory and is often connected to it.
Red Hat lists the ipa packages in these products as affected:
- Red Hat Enterprise Linux 9, including the 9.8 extended support streams
- Red Hat Enterprise Linux 9.6 EUS, AUS and Update Services for SAP Solutions
- Red Hat Enterprise Linux 10, including the 10.2 extended support streams
- Red Hat Enterprise Linux 10.0 EUS
- all architectures: x86_64, ARM 64, IBM Power and IBM Z
The vulnerable part is the directory service on FreeIPA servers, but Red Hat ships updated client packages in the same release. FreeIPA is also available in other Linux distributions. If you run it outside RHEL, watch your distribution's security advisories. If you use neither FreeIPA nor IdM, this flaw does not affect you.
How to check if you are affected
All commands below only read information and change nothing. Run them on every IPA server, including replicas.
Check the OS release and the installed FreeIPA packages:
cat /etc/redhat-release
rpm -q ipa-server ipa-clientCompare the output with the fixed builds: RHEL 9 ipa-4.13.4-1.el9_8, RHEL 10 ipa-4.13.4-1.el10_2, RHEL 9.6 EUS ipa-4.12.2-14.el9_6.8, RHEL 10.0 EUS ipa-4.12.2-15.el10_0.7. The same or a newer version means the fix is installed.
The update database shows whether a fix for this flaw is still pending. If the command prints nothing, the fix is already installed or does not apply to the system:
dnf updateinfo list --cve CVE-2026-76578To see whether the server accepts connections on the LDAP ports (389 and 636), run the command below. Then check on your firewall which networks can reach those ports:
ss -tln | grep -E ':389|:636'How to fix it
Red Hat has released fixed packages in security advisories RHSA-2026:70564 (RHEL 9), RHSA-2026:72279 (RHEL 10), RHSA-2026:83083 (RHEL 9.6 EUS) and RHSA-2026:82935 (RHEL 10.0 EUS). The fixed builds are ipa-4.13.4-1.el9_8, ipa-4.13.4-1.el10_2, ipa-4.12.2-14.el9_6.8 and ipa-4.12.2-15.el10_0.7.
- Back up the IPA server, for example with
ipa-backup(a standard backup briefly stops the services) or with a VM snapshot. - Update the servers reachable from the most networks first, then all remaining replicas. Every unpatched replica stays vulnerable.
- Update the whole system, not just the ipa packages. The flaw description mentions a related, separately tracked flaw in the directory server.
- After updating, confirm that all FreeIPA services are running and recheck the version with the commands from the check section.
- Finally, update the client machines.
sudo dnf update
sudo ipactl statusRed Hat does not list a workaround in its advisories. Until you have patched, restrict access to the LDAP ports (389 and 636) on your firewall to the networks and machines that genuinely need it. This is general hardening, not a vendor-provided mitigation, and it does not remove the flaw.
What if you may already be compromised
Red Hat's advisories list no specific indicators of compromise. Since the flaw leads to unauthorized membership in the administrators group, focus your review there. The commands below only read data but require an admin login via kinit admin.
ipa group-show admins --all --raw
ipa user-find --all
ipa host-find
ipa service-find
ipa otptoken-find- unknown or recently added members of the
adminsgroup (--rawalso shows members that are not regular users) - new user, host or service accounts that nobody on your team created
- OTP tokens that do not belong to known users
- write operations from unauthenticated (anonymous) connections in the directory server logs under
/var/log/dirsrv/
If you find anything suspicious, treat it as a takeover of the entire FreeIPA domain, because an administrator could have changed passwords, permissions and settings on every enrolled server. At that point, bring in an incident response specialist. Preserve the logs first and do not delete suspicious accounts until someone has examined them.