Homepage

Eval Injection The advisory has been revoked - it doesn't affect any version of package ipa-common  (opens in a new tab)

Threat Intelligence

EPSS
0.9% (60th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-IPACOMMON-19642153
  • published8 Sept 2026
  • disclosed7 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 7 Sep 2026

CVE-2026-79678  (opens in a new tab)
CWE-95  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ipa-common package and not the ipa-common package as distributed by RHEL.

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.