Red Hat published CVE-2026-76578 at a 9.8 on September 7, said it confirmed the underlying technique against a default, unmodified installation, and listed no fixed package for any affected product.
What happened
Red Hat published CVE-2026-76578 to the National Vulnerability Database on September 7, 2026, at 1:20 p.m. UTC. The record is still in NVD’s Received state — no analyst enrichment, no CPE data — and carries one CVSS score, from the assigning CNA [email protected]: 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness is CWE-306, missing authentication for a critical function.
The description, in full:
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server’s ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
Red Hat’s CSAF VEX document for the flaw, released the same day, is titled “ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI.” Its statement:
This is a Critical flaw allowing complete, unauthenticated compromise of a FreeIPA/IdM server’s administrative privileges. Exploitation of the original collision-based technique has been independently confirmed by Red Hat against a default, unmodified FreeIPA installation and requires no credentials, user interaction, or prior access, only network reachability to the LDAP service.
And the remediation Red Hat offers is not a package:
Until a fixed package is available, restrict network access to the LDAP service (typically ports 389/636) to trusted hosts only, using firewall rules or network segmentation. Disabling anonymous LDAP binds blocks this specific attack path.
The VEX product status is one-sided. Every IdM package Red Hat enumerates across Red Hat Enterprise Linux 6, 7, 8, 9, and 10 — ipa-server, ipa-client, python3-ipaserver, python3-ipaclient and their relatives — sits under known_affected. Nothing sits under fixed, and nothing under known_not_affected. The RHEL 6 packages carry the remediation category “no fix planned,” out of support scope; everything else is “none available.”
The other half of the chain, and what it scored
The description says the flaw is exploited “combined with a related flaw in the underlying directory server’s ACI evaluation (tracked separately).” That companion is CVE-2026-76560, published an hour later, at 2:16 p.m. UTC on September 7, also from [email protected], also in Received state. Its description:
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client’s empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.
It is scored 7.5, CWE-863, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. Red Hat’s severity label on it is “Important,” not Critical. Its VEX lists 41 affected products, one not affected — Red Hat Directory Server 13 — and zero fixed. The stated workaround is to review ACIs using userattr='attribute#SELFDN' or userattr='attribute#USERDN' bind rules on attributes permitted to hold an explicit empty value, add authmethod restrictions, or turn off anonymous access where it is not needed.
Read the two vectors side by side and the arithmetic is visible. The 389-ds half is integrity-only — C:N/I:H/A:N — because on its own it lets an anonymous client write a directory entry it should not be able to write. Bolted to the FreeIPA ACI, that write becomes a Kerberos principal in the administrators group and the impact metrics go to C:H/I:H/A:H. The 7.5 is honest about the bug in isolation. It is also the load-bearing half of a 9.8.
Why it matters
FreeIPA, shipped by Red Hat as Identity Management, is not an application that happens to hold credentials. It is the thing that decides who everything else believes you are: Kerberos principals, host enrollment, HBAC rules, sudo policy, certificates issued through the embedded CA. A flaw that produces genuine administrators-group membership does not compromise a server — it compromises every account and every host that server governs, using credentials the rest of the environment has no reason to distrust, because they are real.
That is what makes the “no fixed package” line the operative fact rather than the score. A 9.8 with an errata attached is a maintenance window. A 9.8 whose remediation section says “until a fixed package is available” is an architecture decision made under time pressure. Restricting 389 and 636 to trusted hosts is a real control, and for a directory server it is the control that should already exist. But an IdM server whose LDAP ports are reachable from the general user network is not a misconfiguration; it is the common shape, because clients bind to it.
The scoring split deserves attention beyond this pair. Vulnerability queues are triaged by number, and the number here is doing exactly what CVSS is designed to do: describe one vulnerability’s own impact. It cannot describe that the 7.5 is the step that makes the 9.8 reachable. Here the practical consequence is small, since both flaws live in packages an administrator updates together and neither has a patch. The pattern is what carries forward: when a vendor writes “combined with a related flaw … tracked separately,” the separately tracked flaw’s score is not a measure of how urgent it is.
There is also a history the record only gestures at. Red Hat’s page for CVE-2026-76578 cross-references CVE-2026-13097, an earlier FreeIPA issue disclosed on August 27, 2026 and scored 8.7, in which the uniqueness constraint on Kerberos principal-name attributes in 389-ds did not account for equivalent representations of the same principal name. Red Hat’s VEX for that flaw lists 74 affected products and, eleven days later, still zero fixed. The externally visible state is two unfixed FreeIPA privilege-escalation records filed eleven days apart, in a component whose whole job is deciding privilege.
One distinction coverage of this will probably blur, so state it plainly. Red Hat says it independently confirmed exploitation of the original collision-based technique against a default, unmodified installation. That is a vendor confirming the flaw is exploitable in a stock configuration — a stronger claim than most advisories make. It is not a report of exploitation in the wild. No vendor, agency, or researcher has reported attacks using CVE-2026-76578, and the NVD record carries no CISA KEV fields: cisaExploitAdd, cisaActionDue, cisaVulnerabilityName and cisaRequiredAction are all absent. There is no federal remediation deadline here today.
The record’s state carries a cost of its own. A CVE in Received status has no NVD-assigned CPE, and scanners that match on CPE have nothing to match. An organization running Red Hat IdM can scan this week and see nothing for either half of this chain — not because it is unaffected, but because the record has not been enriched.
What to do
- Inventory FreeIPA and Red Hat IdM servers across RHEL 6 through 10. Red Hat names
ipa-server,ipa-client,python3-ipaserver,python3-ipaclientand related packages as affected. RHEL 6 will not receive a fix at all. - Apply the vendor workaround as written: restrict network access to LDAP on 389 and 636 to trusted hosts using firewall rules or network segmentation.
- Disable anonymous LDAP binds after confirming nothing in the deployment depends on them. Red Hat says this blocks “this specific attack path” — read the qualifier as written; it is not a fix.
- Review SELFDN and USERDN ACIs per the CVE-2026-76560 guidance: check whether the bind-rule attribute can hold an explicit empty value, and add
authmethodrestrictions where it can. - Hunt for the observable, not the exploit. The end state of this chain is a Kerberos principal in the administrators group. Enumerate current admins-group membership and recently created principals against a known-good list — that check works whether or not you can see the LDAP traffic that created them.
- Track Red Hat’s CVE pages directly for errata rather than a CPE-based scan, which will not match these records while they sit in
Received.
Sourcing note
Checked: the NVD API records for CVE-2026-76578 and CVE-2026-76560, retrieved September 7, 2026, both showing vulnStatus Received, lastModified equal to their publication timestamps, and no CISA KEV fields; Red Hat’s CVE pages for both; Red Hat’s CSAF VEX documents for CVE-2026-76578, CVE-2026-76560 and CVE-2026-13097 at security.access.redhat.com, which are the source for the product-status and remediation counts. All description, statement, and mitigation text above is quoted verbatim from Red Hat’s records.
Could not reach: freeipa.org’s release-notes page returned a 404 to automated retrieval, so this story reports no upstream FreeIPA release position. No Red Hat errata for either CVE was found; the advisory index surfaced only RHSA-2026:36195, a 389-ds-base update issued July 7, 2026 for unrelated CVEs. cisa.gov returns 403 to automated fetching, so KEV status here is taken from the CISA fields republished inside the NVD records, which were absent.
Unresolved: the exact relationship between CVE-2026-76578 and CVE-2026-13097 — whether the August work was incomplete or addressed a genuinely different path — is not spelled out in either record, and this story does not assert one. Bugzilla 2519522 and 2519521 are cited by the records but were not read. Affected-product counts are Red Hat’s VEX figures as retrieved today and will change as triage continues.