CRITICAL: FreeIPA CVE-2026-76578 Gives Anonymous Clients Admin Rights

Identity management is the part of the stack whose entire job is deciding who gets to be somebody. So when the answer turns out to be that being nobody at all is the fastest path into the administrators group, that is worth an unscheduled evening.

Red Hat published a batch of advisories on September 8, 2026, covering a vulnerability chain in FreeIPA, the upstream project behind Red Hat Identity Management and the directory backbone for a lot of Linux estates that never wanted to run Active Directory. The headline issue is CVE-2026-76578, rated critical with a preliminary CVSS score of 9.8. The short version is that a client which has never authenticated, holds no credentials, and has no prior foothold in the environment can create a Kerberos principal with a name of its own choosing and end up with that principal sitting in the administrators group. Not a stolen session. Not a token that expires in an hour. A real, reusable administrator identity that outlives the connection that created it.

Two Bugs That Only Matter Together

The interesting part is that neither half of this is especially dramatic on its own, which is how these things usually go. FreeIPA ships an access control instruction that lets users manage their own one-time-password tokens without authenticating first. That sounds reckless until you remember why it exists, because a user enrolling a token for the first time does not yet have the second factor they are enrolling. The mistake is not that the rule permits an unauthenticated write. The mistake is that the rule never bothered to constrain what else could be written alongside the token entry.

The other half lives one layer down in 389 Directory Server, tracked as CVE-2026-76560 with a CVSS score of 7.5. Its access control engine offers a rule type meant to enforce that only the authenticated owner of an entry may touch it. The engine implements that check by comparing the client's identity against the stored value as plain text. An unauthenticated client has an empty name. An entry the attacker just created has empty ownership fields. Empty matches empty, the ownership check returns a cheerful yes, and the attacker is formally recognized as the owner of an object precisely because they are nobody.

Chain the two and the attack reads like a bureaucratic exploit rather than a memory corruption one. The attacker connects anonymously over LDAP, creates a token entry with blank ownership attributes, passes the ownership test on the strength of being unauthenticated, and then writes a Kerberos principal and a password of their choosing into the same operation the token rule was happy to allow. Group membership comes along for the ride. At no point does anything crash, no shellcode gets executed, and nothing looks like an exploit. It looks like LDAP doing exactly what it was told.

If this feels familiar, that is because FreeIPA 4.13.3 already shipped a fix for CVE-2026-13097, which blocked an account impersonation trick by preventing Kerberos name collisions. That patch closed the specific door somebody walked through last time and left the unauthenticated write itself standing. The current chain simply declines to collide with anything and uses attacker-chosen names instead, which is a useful reminder that fixing the exploit is not the same as fixing the bug.

What Is Affected and How Bad It Gets

FreeIPA fixed its side in version 4.13.4, with 4.13.1 and earlier called out as vulnerable in the advisory. The directory server side is messier. Red Hat has 389-ds-base fixed on RHEL 10 in 389-ds-base-3.2.0-10.el10_2, and as of September 8 there was no fix listed for RHEL 9, the Fedora update was still sitting in QA, and the Red Hat Directory Server advisory was still pending. Fourteen advisories went out that day, which tells you roughly how many places this code lives.

What elevates this above the usual critical CVE is that it needs nothing. No credentials, no user interaction, no prior access, no unusual configuration. Red Hat reproduced the chain twice against default installations, including from a machine with no access to the environment at all, and validated the outcome using ordinary administrator-only commands rather than trusting what the proof of concept claimed. Default and unmodified is the vulnerable state here, so if you have not changed anything, that is not a defense.

For deployments configured with Windows-style security identifiers the blast radius widens further, because the attacker can obtain Kerberos tickets carrying authorization data and extend that access to HTTP services and to Dogtag, which is the certificate authority. An attacker who reaches the CA is no longer just an administrator in your directory. They are in a position to issue certificates, and certificates are how the rest of your environment decides what to trust. That is the sort of compromise where the incident report keeps growing for weeks after the patch went on.

The good news, such as it is, comes with an asterisk. None of the advisories or bug reports describe this being used in a real attack, and nobody has published indicators of compromise. The bad news is the same sentence read from the other direction. The technique is public, the writeups explain the logic clearly, and it targets a service that by design sits there listening for LDAP connections. The gap between publication and opportunistic scanning for something this cheap to attempt is usually measured in days rather than months.

Patching, Mitigations, and Finding Out If You Were Already Hit

Get to FreeIPA 4.13.4 and pick up the 389-ds-base update for your platform as soon as your distribution ships it. If you are on RHEL 9 or Red Hat Directory Server and the fix is not there yet, you are in mitigation territory rather than patch territory, and mitigation here means network control. Restrict access to the LDAP service on ports 389 and 636 with firewall rules or segmentation so that only hosts with a reason to talk to your directory can reach it. Disabling anonymous LDAP binds also breaks the chain, but verify first that nothing in your deployment quietly depends on them, because plenty of monitoring and integration tooling does, and finding that out the hard way at two in the morning is a bad trade.

There is a third issue in the same batch worth patching for on its own merits. CVE-2026-79678 affects the idp-add command, carries a CVSS score of 8.1, and is unrelated to the anonymous write chain. It has no configuration workaround at all, so patching is the only answer. FreeIPA 4.13.4 covers it as well, which conveniently means one upgrade handles both. If you run FreeIPA in containers, also confirm that bootstrap passwords set at first boot are no longer sitting in the environment of the running process, which is the sort of thing that stays true long after everyone has forgotten about it.

Detection is where you have to do your own homework, because neither the advisories nor the bug reports published rules or indicators. Start from the outcome rather than the technique. Enumerate the current membership of the administrators group and compare it against a roster you actually trust, because the whole point of this attack is that it produces a legitimate looking principal rather than an obvious anomaly. Look for Kerberos principals nobody remembers creating and for recently added entries with creation timestamps that do not line up with any change ticket. In the 389 Directory Server access logs, anonymous binds followed by add operations against the one-time-password token containers are the signature of the chain, and token entries with blank ownership attributes are what the attack leaves behind. If your directory has been reachable from untrusted networks, treat that review as mandatory rather than optional.

Two questions remain genuinely unanswered in the public material, and both matter for cleanup. It is not clear whether updating 389-ds-base alone stops the FreeIPA attack when the ipa packages themselves stay outdated, so do not assume half the patch is enough. It is also not clear whether applying the fixes removes identities an attacker already created, and the safe assumption there is that it does not. Patching a lock does not evict somebody already inside the building. If you have any reason to think you were reached, the work after the upgrade is auditing group membership, deleting principals you cannot account for, and rotating credentials on the assumption that an administrator identity had time to look around.

The through line here is worth sitting with. This is not a clever memory corruption bug or an exotic cryptographic break. It is an access control rule that was written to be permissive for a good reason and never told where to stop, sitting on top of a comparison routine that treated an empty string as a valid identity. Both were reasonable decisions in isolation. Together they hand out administrator credentials to anyone who asks politely in LDAP.

The MSP Angle

This one sells itself to any client running Linux identity infrastructure, because the honest question is not whether they have patched but whether they can enumerate who sits in their administrators group right now and prove every entry belongs. Most cannot, and a directory hygiene assessment covering privileged group membership, anonymous bind exposure, and LDAP network reachability is an easy engagement to scope and an easier one to repeat quarterly. It also pairs naturally with an identity monitoring retainer, since the lesson of CVE-2026-76578 is that the account worth worrying about is the one that looks completely legitimate.