Описание
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
Отчет
This flaw only affects Identity Management (IdM/FreeIPA) servers where a cross-forest trust with Active Directory has been established (via ipa-adtrust-install and ipa trust-add). Servers without an active AD trust are not affected, since the trust object and the ADTRUST component required to reach the vulnerable code path do not exist in that configuration. Exploitation requires an ordinary, non-administrative IdM user account to trigger the vulnerable trust-fetch-domains command against a server of the attacker's choosing — no delegated administrative privilege of any kind is required. On its own, this lets an authenticated non-admin user force the IdM server to launch a privileged helper process and initiate a network connection to attacker-controlled infrastructure. Impersonating accounts in the trusted Active Directory domain — additionally requires the attacker to intercept and relay the resulting Kerberos authentication traffic, force a downgrade to the weaker encrypted-timestamp pre-authentication mechanism, and successfully recover the trust's interrealm secret through that downgrade.
Меры по смягчению последствий
This issue is fixed upstream. Administrators should apply this fix once available for their platform. Until then, the previously suggested compensating control (restricting "System: Read Trust Information" so it is not granted to all authenticated users) remains a valid interim workaround, with the same caveat that doing so may affect SSSD subdomain support, which relies on that permission's default breadth.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | ipa | Not affected | ||
| Red Hat Enterprise Linux 10 | ipa | Fixed | RHSA-2026:72279 | 28.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | ipa | Fixed | RHSA-2026:82935 | 14.10.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | ipa | Fixed | RHSA-2026:93071 | 30.10.2026 |
| Red Hat Enterprise Linux 8 | idm | Fixed | RHSA-2026:83460 | 15.10.2026 |
| Red Hat Enterprise Linux 8 | idm | Fixed | RHSA-2026:83460 | 15.10.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | idm | Fixed | RHSA-2026:93452 | 02.11.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | idm | Fixed | RHSA-2026:93452 | 02.11.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | idm | Fixed | RHSA-2026:93452 | 02.11.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | idm | Fixed | RHSA-2026:93452 | 02.11.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.2 High
CVSS3
Связанные уязвимости
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
A flaw was found in FreeIPA. The trust-fetch-domains command is gated ...
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
EPSS
8.2 High
CVSS3