Homepage

Missing Authentication for Critical Function The advisory has been revoked - it doesn't affect any version of package ipa-server-trust-ad  (opens in a new tab)

Threat Intelligence

EPSS
1.21% (68th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-IPASERVERTRUSTAD-19642280
  • published8 Sept 2026
  • disclosed7 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 7 Sep 2026

CVE-2026-76578  (opens in a new tab)
CWE-306  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ipa-server-trust-ad package and not the ipa-server-trust-ad package as distributed by RHEL.

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.