Flaws in FreeIPA and 389 Directory Server Enable Anonymous LDAP Attack

FreeIPA LDAP attack may, on vulnerable, network-accessible default deployments, lead to the creation of an attacker-chosen Kerberos principal and password without an existing account. The issue results from chaining CVE-2026-76578 in FreeIPA and CVE-2026-76560 in 389 Directory Server. The FreeIPA project has already released version 4.13.4, which fixes the first vulnerability.

According to Red Hat, the attack begins with an anonymous LDAP client. It can create an OTP record with empty owners and then insert a new Kerberos principal and password of its own choosing. Since FreeIPA serves as a central platform for identity and authorization management, the potential impact is not limited to the LDAP directory itself but may also affect access to systems managed in that domain.

How the FreeIPA LDAP attack occurs

CVE-2026-76578 is related to an overly permissive Access Control Instruction (ACI) rule in FreeIPA for self-service OTP tokens. On its own, however, this issue would not constitute the described path to inserting a principal. The decisive factor is its combination with CVE-2026-76560 in 389 Directory Server, which concerns the processing of SELFDN ACI rules.

Red Hat states that the flaw in 389 Directory Server may allow an anonymous client to bypass SELFDN ACI. This vulnerability has a preliminary CVSS score of 7.5. On its own, it affects only deployments that use the relevant SELFDN or USERDN ACI rule; Red Hat Directory Server does not provide such a policy by default. In combination with FreeIPA’s configuration, however, a significantly more serious scenario arises.

The vendor reproduced the chain on an unmodified FreeIPA 4.13.1 installation running from a container. The test was performed by a client without prior access. Red Hat then verified the created principal’s membership in the admins group and an administrative operation.

Difference in descriptions of the potential impact

In its release notes, FreeIPA describes the issue more cautiously as a possible stepping stone to administrative privileges. Red Hat’s entry, by contrast, reports the reproduced acquisition of repeatable administrative Kerberos credentials. This is a difference in how the impact is worded, not two separate flaws: both descriptions refer to the stated CVE-2026-76578 and CVE-2026-76560 chain.

The available materials do not publicly confirm exploitation of this chain in real-world attacks. They also do not clearly identify detection indicators or confirm that the update alone removes principals or other records that may have been created before the fix was deployed.

What administrators should do

FreeIPA 4.13.4 addresses CVE-2026-76578 by tightening the ACI. Administrators should update both FreeIPA and 389 Directory Server using the fixed packages available for their specific distribution. For supported releases of Red Hat Enterprise Linux and Fedora, administrators should monitor the release of fixed ipa packages.

Until an update is possible, or as an additional exposure-reduction measure, Red Hat recommends disabling anonymous LDAP binds where operationally feasible. Another option is to make LDAP accessible only from trusted networks. These steps should be evaluated in light of the dependencies of the specific deployment.

Further information is expected, particularly on the exact scope of affected versions, the final CVSS rating, and any recommendations for forensic checks of unknown Kerberos principals, OTP records, and membership in privileged groups. Any confirmation of active exploitation will also be important.

Verified and updated: 09/08/2026 15:28