Red Hat has disclosed a critical flaw chain in FreeIPA, the open source identity management platform that pairs a Kerberos directory with LDAP for enterprise Linux environments, that lets a client which has never logged in walk away with full administrator group membership. The lead flaw, CVE-2026-76578, scores 9.8 of 10 on CVSS. It works because the self-managed OTP token access control instruction requires no authentication and does not restrict which attributes a client can attach alongside the token entry, letting an unauthenticated LDAP client create a Kerberos principal of its own choosing. Chained with a related directory-server access-control evaluation flaw, CVE-2026-76560, that principal lands directly in the administrators group.
The default FreeIPA install ships the exact access-control shape the chain exploits, so no misconfiguration is required to be exposed. Red Hat’s own advisory calls it “a Critical flaw allowing complete, unauthenticated compromise of a FreeIPA/IdM server’s administrative privileges,” reachable over network access to LDAP alone, with no user interaction. On SID-enabled deployments, the compromised administrator group membership extends into other Identity Management services beyond the directory itself, meaning one unauthenticated request can compromise the authentication backbone every downstream Kerberos-reliant service depends on.
The detail worth sitting with is where the fault line actually falls. Red Hat notes its Directory Server product does not ship a default rule shaped like the vulnerable one, but FreeIPA’s own installer does, which is why an out-of-the-box deployment is exposed even though the underlying directory server component is not inherently at fault. That is a downstream-integration gap, not a coding bug in the traditional sense, and it is a reminder that identity infrastructure inherits risk from every layer that configures it, not just the layer that ships the code. Until organizations patch, Red Hat recommends restricting LDAP port access (389 and 636) at the firewall and disabling anonymous LDAP binds.
This follows a pattern this publication has tracked in identity infrastructure, and echoes the same two-flaw chaining approach seen in a recent MikroTik router vulnerability chain.
Source: Red Hat
