Поиск уязвимостей
Количество 12
Количество 12
GHSA-cgrx-2q4j-9f37
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
CVE-2026-76578
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
CVE-2026-76578
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
CVE-2026-76578
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
CVE-2026-76578
A flaw was found in FreeIPA. The self-managed OTP token ACI does not r ...
RLSA-2026:83460
Critical: idm:DL1 security, bug fix, and enhancement update
RLSA-2026:72279
Critical: ipa security, bug fix, and enhancement update
RLSA-2026:70564
Critical: ipa security, bug fix, and enhancement update
ELSA-2026-83460
ELSA-2026-83460: idm:DL1 security, bug fix, and enhancement update (CRITICAL)
ELSA-2026-72279
ELSA-2026-72279: ipa security, bug fix, and enhancement update (CRITICAL)
ELSA-2026-70564
ELSA-2026-70564: ipa security, bug fix, and enhancement update (CRITICAL)
ALT-PU-2026-18151
ALT-PU-2026-18151: package `freeipa` update to version 4.12.5-alt6.gitb360c852d3
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-cgrx-2q4j-9f37 A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services. | CVSS3: 9.8 | 1% Низкий | 2 месяца назад |
 | CVE-2026-76578 A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services. | CVSS3: 9.8 | 1% Низкий | 2 месяца назад |
 | CVE-2026-76578 A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services. | CVSS3: 9.8 | 1% Низкий | 2 месяца назад |
 | CVE-2026-76578 A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services. | CVSS3: 9.8 | 1% Низкий | 2 месяца назад |
| CVE-2026-76578 A flaw was found in FreeIPA. The self-managed OTP token ACI does not r ... | CVSS3: 9.8 | 1% Низкий | 2 месяца назад |
 | RLSA-2026:83460 Critical: idm:DL1 security, bug fix, and enhancement update | 26 дней назад | ||
| RLSA-2026:72279 Critical: ipa security, bug fix, and enhancement update | около 1 месяца назад | ||
| RLSA-2026:70564 Critical: ipa security, bug fix, and enhancement update | около 2 месяцев назад | ||
| ELSA-2026-83460 ELSA-2026-83460: idm:DL1 security, bug fix, and enhancement update (CRITICAL) | 26 дней назад | ||
| ELSA-2026-72279 ELSA-2026-72279: ipa security, bug fix, and enhancement update (CRITICAL) | около 1 месяца назад | ||
| ELSA-2026-70564 ELSA-2026-70564: ipa security, bug fix, and enhancement update (CRITICAL) | около 2 месяцев назад | ||
| ALT-PU-2026-18151 ALT-PU-2026-18151: package `freeipa` update to version 4.12.5-alt6.gitb360c852d3 | CVSS3: 9.8 | 25 дней назад |
Уязвимостей на страницу