CVE-2026-76578: A flaw was found in FreeIPA

This month

CRITICAL 9.8REMOTE

CVE-2026-76578 is a critical-severity flaw (CVSS 9.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remo

Why this priority

Critical severity
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.2% (top 32%)
CISA exploited list	No
Weakness	CWE-306
Published	2026-09-07
Last modified	2026-10-26

Publisher (CNA): Red Hat, Inc.

Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

2026-09-07 13:20 UTCPublished CVE record published
2026-10-26 14:16 UTCUpdated Record last modified

Exact fixes by distribution

Debian 12 · freeipa · NO FIX YET

Debian 13 · freeipa · NO FIX YET

RHEL 10 · ipa · FIXED · ipa-4.13.4-1.el10_2

sudo dnf upgrade --advisory=RHSA-2026:72279 rpm -q ipa

RHEL 10.0 Extended Update Support · ipa · FIXED · ipa-4.12.2-15.el10_0.7

sudo dnf upgrade --advisory=RHSA-2026:82935 rpm -q ipa

RHEL 9 · ipa · FIXED · ipa-4.13.4-1.el9_8

sudo dnf upgrade --advisory=RHSA-2026:70564 rpm -q ipa

RHEL 9.2 Update Services for SAP Solutions · ipa · FIXED · ipa-4.10.1-12.el9_2.7

sudo dnf upgrade --advisory=RHSA-2026:83085 rpm -q ipa

RHEL 9.4 Update Services for SAP Solutions · ipa · FIXED · ipa-4.11.0-15.el9_4.9

sudo dnf upgrade --advisory=RHSA-2026:83084 rpm -q ipa

Amazon Linux 2 · see advisory · FIXED · ALAS2-2026-3916 · source

sudo yum update --advisory=ALAS2-2026-3916

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: BrainBob/CVE-2026-76578 (0 stars)
Write-up: bugzilla.redhat.com/show_bug.cgi?id=2519522

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-76578?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2026-76578 being exploited?

CVE-2026-76578 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-76578 affect?

CVE-2026-76578 affects affected software. Severity is critical (CVSS 9.8). A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a rela

How urgent is CVE-2026-76578?

Priority 59/100. Critical severity; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

References

← Back to latest CVEs