FreeIPA users and Red Hat Identity Management administrators should treat CVE-2026-76578 as a critical authentication-bypass flaw that can lead to full administrative compromise. Red Hat says a remote attacker with only LDAP network access can exploit the issue without credentials or user interaction, and NVD echoes the same core description.
The weakness sits in FreeIPA’s self-managed OTP token ACI, which does not require authentication and does not properly restrict extra attributes added with a token entry. In Red Hat’s advisory, that flaw is chained with a separate directory-server ACI evaluation problem so an attacker can create an arbitrary Kerberos principal and get it placed into the administrators group.
That matters because administrator-group membership in FreeIPA is not symbolic; it grants real control over identity and directory operations. Red Hat says the attacker can perform privileged reads, create or delete entries, and potentially disrupt the directory, while SID-enabled deployments may extend the blast radius to other IdM services. External security writeups also describe the issue as affecting default FreeIPA installations and rate it 9.8 Critical.
Red Hat lists the CVSS v3.1 vector as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which matches a network-only attack with no privileges or user interaction required. The company also notes that the original collision-based technique was independently reproduced on a stock FreeIPA installation, underscoring that the issue is practical rather than theoretical. NVD’s record shows the same vulnerability text and links back to Red Hat as the source.
The immediate defensive advice is to restrict LDAP ports 389 and 636 to trusted hosts using firewall rules or segmentation. Red Hat also says disabling anonymous LDAP binds can block this attack path, but administrators should verify that doing so will not break any legitimate anonymous-bind workflows first. The FreeIPA project’s fix is reported in version 4.13.4 by external coverage, and that update is the cleanest long-term remediation path.
Read the original article: