Red Hat Product Errata RHSA-2026:98078 - Security Advisory
Issued:
2026-11-11
Updated:
2026-11-11

RHSA-2026:98078 - Security Advisory

Synopsis

Important: ipa security, bug fix, and enhancement update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for ipa is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

  • FreeIPA: idm: IdM/FreeIPA Web UI - Client-side open redirect in reset_password.html (CVE-2026-53683)
  • ipa: FreeIPA: Unauthenticated DoS in session endpoints (login_password, change_password, sync_token) via Unbounded Request Body Read (CVE-2026-86593)

Bug Fix(es) and Enhancement(s):

  • ipa: IdM/FreeIPA Web UI - Client-side open redirect in reset_password.html [rhel 10.3z] (JIRA:RHEL-261481)
  • [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL10.3] (JIRA:RHEL-277812)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 10 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 10 s390x
  • Red Hat Enterprise Linux for Power, little endian 10 ppc64le
  • Red Hat Enterprise Linux for ARM 64 10 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 10 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 10 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x

Fixes

  • BZ - 2487512 - CVE-2026-53683 FreeIPA: idm: IdM/FreeIPA Web UI - Client-side open redirect in reset_password.html
  • BZ - 2529709 - CVE-2026-86593 ipa: FreeIPA: Unauthenticated DoS in session endpoints (login_password, change_password, sync_token) via Unbounded Request Body Read
  • RHEL-277812 - [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL10.3]

Red Hat Enterprise Linux for x86_64 10

SRPM
ipa-4.13.4-1.el10_3.1.src.rpm SHA-256: bbb5b80f53e4ad763f762256237e7486190f601743223a7ad80edd4e701aa3f0
x86_64
ipa-client-4.13.4-1.el10_3.1.x86_64.rpm SHA-256: 179bb7a0f5d960cd03e5c408353723bb86136b855b9c6eec48a56d3e7b9e3711
ipa-client-common-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 4c67f6c6fe6d372390ed7509cdc2b22275ce93a04e91fe15382abcc9573c1c96
ipa-client-debuginfo-4.13.4-1.el10_3.1.x86_64.rpm SHA-256: 57441c919419caefa31a91feea3fe765ad51e387091f1f128c6ceb44386a39a3
ipa-client-encrypted-dns-4.13.4-1.el10_3.1.x86_64.rpm SHA-256: 97e4cccbd47b117be13ec3f855ce6623ecbbe8bf32b377278f9e1aa07ced0c6c
ipa-client-epn-4.13.4-1.el10_3.1.x86_64.rpm SHA-256: 66c9eb62a937fe1d381c62fcd2ece5bc3df7e8bcefaa2edf6009a9ddeada9c75
ipa-client-samba-4.13.4-1.el10_3.1.x86_64.rpm SHA-256: e75c40644d351087f54f9637be938193968bc23886ae002b0d5688d2b5f05b04
ipa-common-4.13.4-1.el10_3.1.noarch.rpm SHA-256: b9d8706161212baf30ef00349013ed3e5b443424f2079100b5da60f387d1c4d6
ipa-debuginfo-4.13.4-1.el10_3.1.x86_64.rpm SHA-256: 155641096ef41d81729c34594baf7a0ba8927ce957435279e3ea89aec3830ebf
ipa-debugsource-4.13.4-1.el10_3.1.x86_64.rpm SHA-256: 1b926615941d9ed84beaa829449cbdea3b944ee1a303517c6bea8f931f697a4c
ipa-selinux-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 908fcdb3e2480fe16a464942c0653ee496d1eaf470859bdc3097168cca4bb491
ipa-selinux-luna-4.13.4-1.el10_3.1.noarch.rpm SHA-256: a7c9afc239bb1ab6c31ed24d0b6ae630745e4567821060d090bdd9115abcadf7
ipa-selinux-nfast-4.13.4-1.el10_3.1.noarch.rpm SHA-256: c9e485564e60555662ecb96eb698f86ca1867cc63376c92c0a6b9d640b09ac53
ipa-server-4.13.4-1.el10_3.1.x86_64.rpm SHA-256: ad7df0e877f679038d212887a0d8714c061f87940f158350546c94fc340c893d
ipa-server-common-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 6446a382a7945cf97689837d5fa1713295ec5061e6062d51d7f7532366733dc4
ipa-server-debuginfo-4.13.4-1.el10_3.1.x86_64.rpm SHA-256: dc3f0a5e84f89adcea65e397420895261d8f79212f0b2bb6c700f0e7b9265b52
ipa-server-dns-4.13.4-1.el10_3.1.noarch.rpm SHA-256: eaea30f7c1b9f891ec14073b8682d2dbf3cd8de7e94c75a38e6e2eb1dec72439
ipa-server-encrypted-dns-4.13.4-1.el10_3.1.x86_64.rpm SHA-256: aa95b13c6f003b11fc606f5a3dfc7f69b53fa677497c694485fdc430e27ec230
ipa-server-trust-ad-4.13.4-1.el10_3.1.x86_64.rpm SHA-256: e29714406b6d145c3b8e8dbd8e57a0d9b803dd6ab28228a895730f6b9c8eb4e3
ipa-server-trust-ad-debuginfo-4.13.4-1.el10_3.1.x86_64.rpm SHA-256: d1ae6a852ff7a5c9baad4df526488e0c057ccde2f78083d99dedbf35f7de4e65
python3-ipaclient-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 62d1b3348725a3d802f0885c9edd53c7e0785bb66d1bb06d96a3b94ae6cd58f3
python3-ipalib-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 934e6ed4de6a1f2601528bbd4f9f12643ef831f8c005d06b668025d2ba04e5fe
python3-ipaserver-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 1f0cd6dfc7412f0b12810551e57a39abed06831c7817841d2fd006fc0389aaca

Red Hat Enterprise Linux for IBM z Systems 10

SRPM
ipa-4.13.4-1.el10_3.1.src.rpm SHA-256: bbb5b80f53e4ad763f762256237e7486190f601743223a7ad80edd4e701aa3f0
s390x
ipa-client-4.13.4-1.el10_3.1.s390x.rpm SHA-256: d26f848bfae77fd3185968918c3c36db9a38f1d126f31333764f5c38b010b19d
ipa-client-common-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 4c67f6c6fe6d372390ed7509cdc2b22275ce93a04e91fe15382abcc9573c1c96
ipa-client-debuginfo-4.13.4-1.el10_3.1.s390x.rpm SHA-256: 9219cfe8c32d4cf5fa0cba3e28faff6d6594d66743c9dd9f1425418c863679c4
ipa-client-encrypted-dns-4.13.4-1.el10_3.1.s390x.rpm SHA-256: 035bed981461c241779ac5e52cb45af436debf1e8e86635517a15452edbba3c5
ipa-client-epn-4.13.4-1.el10_3.1.s390x.rpm SHA-256: d131107a5dfcf3c71e628d4ee1e6202c8a064f4d34666a18244e864f70473313
ipa-client-samba-4.13.4-1.el10_3.1.s390x.rpm SHA-256: f0c7ca8ab44e78ee8ec03314e86bd5f3a914f14a7c02e89875c5812cb51779c0
ipa-common-4.13.4-1.el10_3.1.noarch.rpm SHA-256: b9d8706161212baf30ef00349013ed3e5b443424f2079100b5da60f387d1c4d6
ipa-debuginfo-4.13.4-1.el10_3.1.s390x.rpm SHA-256: a1efa6edb4e0fbd8aec6d938e7c5958651ad16572894ce7b25ff17f7715dfc26
ipa-debugsource-4.13.4-1.el10_3.1.s390x.rpm SHA-256: 489427f8263c8e703c24deb0a2992b1c077a9673bfeed5c9fabed380932ad2d8
ipa-selinux-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 908fcdb3e2480fe16a464942c0653ee496d1eaf470859bdc3097168cca4bb491
ipa-selinux-luna-4.13.4-1.el10_3.1.noarch.rpm SHA-256: a7c9afc239bb1ab6c31ed24d0b6ae630745e4567821060d090bdd9115abcadf7
ipa-selinux-nfast-4.13.4-1.el10_3.1.noarch.rpm SHA-256: c9e485564e60555662ecb96eb698f86ca1867cc63376c92c0a6b9d640b09ac53
ipa-server-4.13.4-1.el10_3.1.s390x.rpm SHA-256: ec7f72910f0a54fa4d3f50c650bd89d3b99c44c61c5e9a7cdf7d64df01ce9862
ipa-server-common-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 6446a382a7945cf97689837d5fa1713295ec5061e6062d51d7f7532366733dc4
ipa-server-debuginfo-4.13.4-1.el10_3.1.s390x.rpm SHA-256: 82d7b3b633b566f33c4402e9da8a0b1870ea6d086598989ad24924ca542fc75e
ipa-server-dns-4.13.4-1.el10_3.1.noarch.rpm SHA-256: eaea30f7c1b9f891ec14073b8682d2dbf3cd8de7e94c75a38e6e2eb1dec72439
ipa-server-encrypted-dns-4.13.4-1.el10_3.1.s390x.rpm SHA-256: 97c78a87e52130e8b9b8637b35d13ba9e4d2e84bd4d788526aa74367a5cecb4d
ipa-server-trust-ad-4.13.4-1.el10_3.1.s390x.rpm SHA-256: 2200a801b26a7d68c16d569958edac69f0e2611505f9f0f1a179357fe9af8ca4
ipa-server-trust-ad-debuginfo-4.13.4-1.el10_3.1.s390x.rpm SHA-256: cee92e5f6da4bcbbcc6b09f9dbcbda16b96052253d5079f0d2ce663f508493db
python3-ipaclient-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 62d1b3348725a3d802f0885c9edd53c7e0785bb66d1bb06d96a3b94ae6cd58f3
python3-ipalib-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 934e6ed4de6a1f2601528bbd4f9f12643ef831f8c005d06b668025d2ba04e5fe
python3-ipaserver-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 1f0cd6dfc7412f0b12810551e57a39abed06831c7817841d2fd006fc0389aaca

Red Hat Enterprise Linux for Power, little endian 10

SRPM
ipa-4.13.4-1.el10_3.1.src.rpm SHA-256: bbb5b80f53e4ad763f762256237e7486190f601743223a7ad80edd4e701aa3f0
ppc64le
ipa-client-4.13.4-1.el10_3.1.ppc64le.rpm SHA-256: 91787e5785aa80608781c5e523fe855d553d5d15cf5165da9f858557c6cd5971
ipa-client-common-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 4c67f6c6fe6d372390ed7509cdc2b22275ce93a04e91fe15382abcc9573c1c96
ipa-client-debuginfo-4.13.4-1.el10_3.1.ppc64le.rpm SHA-256: b58b677e044a9233cadb23e7b9c94725beaa27419cbe02a327a3d97aa9d9f10c
ipa-client-encrypted-dns-4.13.4-1.el10_3.1.ppc64le.rpm SHA-256: 0f2c85cc2f6e8dd310ed52c46549df10feddd2cd013abb2a3917b48003a269d3
ipa-client-epn-4.13.4-1.el10_3.1.ppc64le.rpm SHA-256: 85ba19597a8098c1356d76081b59355274a5a68afdfed3b0f996179bba884a04
ipa-client-samba-4.13.4-1.el10_3.1.ppc64le.rpm SHA-256: d44bbfebd6ccfcd80679f6120275589cdff85f299faf554ccef08a2f31481840
ipa-common-4.13.4-1.el10_3.1.noarch.rpm SHA-256: b9d8706161212baf30ef00349013ed3e5b443424f2079100b5da60f387d1c4d6
ipa-debuginfo-4.13.4-1.el10_3.1.ppc64le.rpm SHA-256: 68028529cbc7e373e07256b4c8b619f9b123bd5de24d5910afded3c89303e453
ipa-debugsource-4.13.4-1.el10_3.1.ppc64le.rpm SHA-256: b6c6be3bfbdd5094b0e55f35ba65e79fd943e448fe432633ee94a672acbcb227
ipa-selinux-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 908fcdb3e2480fe16a464942c0653ee496d1eaf470859bdc3097168cca4bb491
ipa-selinux-luna-4.13.4-1.el10_3.1.noarch.rpm SHA-256: a7c9afc239bb1ab6c31ed24d0b6ae630745e4567821060d090bdd9115abcadf7
ipa-selinux-nfast-4.13.4-1.el10_3.1.noarch.rpm SHA-256: c9e485564e60555662ecb96eb698f86ca1867cc63376c92c0a6b9d640b09ac53
ipa-server-4.13.4-1.el10_3.1.ppc64le.rpm SHA-256: 03a877cbbfbd8d7462be5f32495384feaf94f82aa05623c0c6ed0e56a82a922c
ipa-server-common-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 6446a382a7945cf97689837d5fa1713295ec5061e6062d51d7f7532366733dc4
ipa-server-debuginfo-4.13.4-1.el10_3.1.ppc64le.rpm SHA-256: 6a014922d78bca9d09e856ed886cefdde769915915879a3bf517d9af76386828
ipa-server-dns-4.13.4-1.el10_3.1.noarch.rpm SHA-256: eaea30f7c1b9f891ec14073b8682d2dbf3cd8de7e94c75a38e6e2eb1dec72439
ipa-server-encrypted-dns-4.13.4-1.el10_3.1.ppc64le.rpm SHA-256: d496709afbebf171ffb7dc8973c21c9b49334517442e2b48e17a0dfbceb8e7c7
ipa-server-trust-ad-4.13.4-1.el10_3.1.ppc64le.rpm SHA-256: 6ae2c4c31c21f671926cde1f52faf9097946876657239a53820ec16fc2b39e77
ipa-server-trust-ad-debuginfo-4.13.4-1.el10_3.1.ppc64le.rpm SHA-256: 35ab7fc7142717c9778e43a673fbc4a4c7a5ed25f9a314ed93b1b7444124c698
python3-ipaclient-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 62d1b3348725a3d802f0885c9edd53c7e0785bb66d1bb06d96a3b94ae6cd58f3
python3-ipalib-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 934e6ed4de6a1f2601528bbd4f9f12643ef831f8c005d06b668025d2ba04e5fe
python3-ipaserver-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 1f0cd6dfc7412f0b12810551e57a39abed06831c7817841d2fd006fc0389aaca

Red Hat Enterprise Linux for ARM 64 10

SRPM
ipa-4.13.4-1.el10_3.1.src.rpm SHA-256: bbb5b80f53e4ad763f762256237e7486190f601743223a7ad80edd4e701aa3f0
aarch64
ipa-client-4.13.4-1.el10_3.1.aarch64.rpm SHA-256: b1ff83edb90bc490f34accdee81d37d184dcebb8331274f8214500d93b91bf30
ipa-client-common-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 4c67f6c6fe6d372390ed7509cdc2b22275ce93a04e91fe15382abcc9573c1c96
ipa-client-debuginfo-4.13.4-1.el10_3.1.aarch64.rpm SHA-256: a45655a934e5376a46113570bf97f17415e91daf1e3b4cb1d3016b9c43a9c84c
ipa-client-encrypted-dns-4.13.4-1.el10_3.1.aarch64.rpm SHA-256: 9cd5f23d16bc1815e5f72886ea438e20170b23dbc92df2b09032301bcbeaac0f
ipa-client-epn-4.13.4-1.el10_3.1.aarch64.rpm SHA-256: 79058742d450e84ed2690ed0ada41a367af8bde071ec7e33e6d351a4f86b2c39
ipa-client-samba-4.13.4-1.el10_3.1.aarch64.rpm SHA-256: 957f993e2a4982c68756ca11811178a7cd36434fab626688bfcd9297380d1ca0
ipa-common-4.13.4-1.el10_3.1.noarch.rpm SHA-256: b9d8706161212baf30ef00349013ed3e5b443424f2079100b5da60f387d1c4d6
ipa-debuginfo-4.13.4-1.el10_3.1.aarch64.rpm SHA-256: 1aff1747d25546fc4290ea846745ebd934b48a5b0cc410fcbe8fd024a979e9f5
ipa-debugsource-4.13.4-1.el10_3.1.aarch64.rpm SHA-256: 6bbc66a08306c81baa0dd96e529bf2fc1953a532627767a2eaf25d30b50ad3e3
ipa-selinux-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 908fcdb3e2480fe16a464942c0653ee496d1eaf470859bdc3097168cca4bb491
ipa-selinux-luna-4.13.4-1.el10_3.1.noarch.rpm SHA-256: a7c9afc239bb1ab6c31ed24d0b6ae630745e4567821060d090bdd9115abcadf7
ipa-selinux-nfast-4.13.4-1.el10_3.1.noarch.rpm SHA-256: c9e485564e60555662ecb96eb698f86ca1867cc63376c92c0a6b9d640b09ac53
ipa-server-4.13.4-1.el10_3.1.aarch64.rpm SHA-256: fdcd5d0c23ac30b9c1ee2b440d22747969cc3e52624d744237f96c4ccde9b15c
ipa-server-common-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 6446a382a7945cf97689837d5fa1713295ec5061e6062d51d7f7532366733dc4
ipa-server-debuginfo-4.13.4-1.el10_3.1.aarch64.rpm SHA-256: edd1d99e66d416ef0b8091eac615a9c06054db6bd9cc13d59da25b584f5f71fe
ipa-server-dns-4.13.4-1.el10_3.1.noarch.rpm SHA-256: eaea30f7c1b9f891ec14073b8682d2dbf3cd8de7e94c75a38e6e2eb1dec72439
ipa-server-encrypted-dns-4.13.4-1.el10_3.1.aarch64.rpm SHA-256: 1a01a14572b388b57c8692d3620031aac53aeedc53d184e24eb1aa5e5b4cb702
ipa-server-trust-ad-4.13.4-1.el10_3.1.aarch64.rpm SHA-256: 0288fbc40dc58a9aa8688b8f87ef6c5c40b96590477511cf3d2a6bce7632a811
ipa-server-trust-ad-debuginfo-4.13.4-1.el10_3.1.aarch64.rpm SHA-256: a4e96ba65807fd651ffdd1924888fb57707767707bd56392ad0d616cf39615ea
python3-ipaclient-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 62d1b3348725a3d802f0885c9edd53c7e0785bb66d1bb06d96a3b94ae6cd58f3
python3-ipalib-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 934e6ed4de6a1f2601528bbd4f9f12643ef831f8c005d06b668025d2ba04e5fe
python3-ipaserver-4.13.4-1.el10_3.1.noarch.rpm SHA-256: 1f0cd6dfc7412f0b12810551e57a39abed06831c7817841d2fd006fc0389aaca

Red Hat CodeReady Linux Builder for x86_64 10

SRPM
x86_64
python3-ipatests-4.13.4-1.el10_3.1.noarch.rpm SHA-256: b8465861ba2addcf36bb10987172f8bd7ab1a7f1a93eff910eec0b6431ff7971

Red Hat CodeReady Linux Builder for Power, little endian 10

SRPM
ppc64le
python3-ipatests-4.13.4-1.el10_3.1.noarch.rpm SHA-256: b8465861ba2addcf36bb10987172f8bd7ab1a7f1a93eff910eec0b6431ff7971

Red Hat CodeReady Linux Builder for ARM 64 10

SRPM
aarch64
python3-ipatests-4.13.4-1.el10_3.1.noarch.rpm SHA-256: b8465861ba2addcf36bb10987172f8bd7ab1a7f1a93eff910eec0b6431ff7971

Red Hat CodeReady Linux Builder for IBM z Systems 10

SRPM
s390x
python3-ipatests-4.13.4-1.el10_3.1.noarch.rpm SHA-256: b8465861ba2addcf36bb10987172f8bd7ab1a7f1a93eff910eec0b6431ff7971

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.