Red Hat Product Errata RHSA-2026:98983 - Security Advisory
Issued:
2026-11-11
Updated:
2026-11-11

RHSA-2026:98983 - Security Advisory

Synopsis

Important: ipa security, bug fix, and enhancement update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for ipa is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

  • FreeIPA: idm: IdM/FreeIPA Web UI - Client-side open redirect in reset_password.html (CVE-2026-53683)
  • ipa: FreeIPA: Unauthenticated DoS in session endpoints (login_password, change_password, sync_token) via Unbounded Request Body Read (CVE-2026-86593)

Bug Fix(es) and Enhancement(s):

  • ipa: IdM/FreeIPA Web UI - Client-side open redirect in reset_password.html [rhel 9.9z] (JIRA:RHEL-261484)
  • [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL9.9] (JIRA:RHEL-277804)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 9 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x

Fixes

  • BZ - 2487512 - CVE-2026-53683 FreeIPA: idm: IdM/FreeIPA Web UI - Client-side open redirect in reset_password.html
  • BZ - 2529709 - CVE-2026-86593 ipa: FreeIPA: Unauthenticated DoS in session endpoints (login_password, change_password, sync_token) via Unbounded Request Body Read
  • RHEL-277804 - [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL9.9]

Red Hat Enterprise Linux for x86_64 9

SRPM
ipa-4.13.4-1.el9_9.1.src.rpm SHA-256: c9fdf8b15a4f4be458467a83eb5e6482799f7c0e63407e1c2d9c9a5ed5d35168
x86_64
ipa-client-4.13.4-1.el9_9.1.x86_64.rpm SHA-256: daf37e0bc7e40a3c51919750406c3adfe9d23439e1b5ed649c52c1345b4b9b61
ipa-client-common-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 438b6eabfbfe4ba158b9cf60d8d50df82e6dca5d12e9135ac2b9a8c3bb65e352
ipa-client-debuginfo-4.13.4-1.el9_9.1.x86_64.rpm SHA-256: d499d33ae317ce7c98a59ba73f22f2ecdb4e3b3a0efc42599959508d46254c93
ipa-client-encrypted-dns-4.13.4-1.el9_9.1.x86_64.rpm SHA-256: a632d22909f29891d3b5f1db636d84960c30b2399d2a27d0dc5af7239a3d970b
ipa-client-epn-4.13.4-1.el9_9.1.x86_64.rpm SHA-256: 1fab9c569c2cc1948942380eb4233692b30592003815c87698fbd82f9c6c0105
ipa-client-samba-4.13.4-1.el9_9.1.x86_64.rpm SHA-256: 79c12cade4308ec524354782e652364aaf74f98f9bff9b2cf2cfad9396a72cc2
ipa-common-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 8a8c5befe89bda75002b5be89975eff98ccb2dd05a391a5400d48ca4f77c4408
ipa-debuginfo-4.13.4-1.el9_9.1.x86_64.rpm SHA-256: f01911743fa7989a0de2cdc84a7242e7c446d22107adff094ee0faf2ca0b58e1
ipa-debugsource-4.13.4-1.el9_9.1.x86_64.rpm SHA-256: f4ea673c3e1b3a2b40dc6516e40131683c0b7e03e15d2637ff458f8d15b30ed7
ipa-selinux-4.13.4-1.el9_9.1.noarch.rpm SHA-256: e2fff702abad86f13ac54f42e35f687773420fea0d18b4110b5d6124025456aa
ipa-selinux-luna-4.13.4-1.el9_9.1.noarch.rpm SHA-256: d2bde3058994561af842667df05d27b62276175707411c913181e6792679eda4
ipa-selinux-nfast-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 34cc8b96830acf0f843b487206e3d1908cd9cca54f14991f28568c3814109285
ipa-server-4.13.4-1.el9_9.1.x86_64.rpm SHA-256: 90550c443d282ad4c7fca03644ceaf96ce0605ab2874fd926a6a932cc364e12f
ipa-server-common-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 9883a2ee5f0b96ee02e4c7369f112a32432a13224969c65a046cf7f936d87751
ipa-server-debuginfo-4.13.4-1.el9_9.1.x86_64.rpm SHA-256: 5f982d2b9906f0d2ee677ad771eaa0c172da9ed4772080f603613c84712d3573
ipa-server-dns-4.13.4-1.el9_9.1.noarch.rpm SHA-256: f0234bb14c6f277641a703879a7fba891188738472de5003b1e64b5d337df2d6
ipa-server-encrypted-dns-4.13.4-1.el9_9.1.x86_64.rpm SHA-256: e6f84c44676e901b258f3c61b44e85af6b8d2dabb8b1fe5bf90e161b02d95bf6
ipa-server-trust-ad-4.13.4-1.el9_9.1.x86_64.rpm SHA-256: 68e557fd3971bffb5ce543dfd68be0d9188d595b0cf9b9a92f4389d2b42a509c
ipa-server-trust-ad-debuginfo-4.13.4-1.el9_9.1.x86_64.rpm SHA-256: 63d3a2f0d2f186429376016b4871ad350f551d0472731852e80020dc7c4a3997
python3-ipaclient-4.13.4-1.el9_9.1.noarch.rpm SHA-256: ffccab7cc1cfda8ca57f6cc44bb355be888b54ae91437c0b52e41ba1fce2195f
python3-ipalib-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 6b8c4cc87292a13c0e5faff07cb537e4290bee51637a0807ae6358c9f21b80d2
python3-ipaserver-4.13.4-1.el9_9.1.noarch.rpm SHA-256: b853a2863abdb3209f2a2d69c68a907861d0ba19dfb6557ba3a485e8df92d9c4

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
ipa-4.13.4-1.el9_9.1.src.rpm SHA-256: c9fdf8b15a4f4be458467a83eb5e6482799f7c0e63407e1c2d9c9a5ed5d35168
s390x
ipa-client-4.13.4-1.el9_9.1.s390x.rpm SHA-256: d787f8f06e929fc45f786cb0725fabc7406f24dc885b7d1e66cd3cea5bbc244f
ipa-client-common-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 438b6eabfbfe4ba158b9cf60d8d50df82e6dca5d12e9135ac2b9a8c3bb65e352
ipa-client-debuginfo-4.13.4-1.el9_9.1.s390x.rpm SHA-256: bc3ca1e1aa9c755ed57327cb5387fcc77be5550d120683cb99b0452f30a11355
ipa-client-encrypted-dns-4.13.4-1.el9_9.1.s390x.rpm SHA-256: f969228b3ab383a900e9ffb18054693f87aba8936c09966ed13036aa57878813
ipa-client-epn-4.13.4-1.el9_9.1.s390x.rpm SHA-256: 8191791772815ad2adc439f545ecbcd7c0d00e56a25ce158a3394d9435e6cfa2
ipa-client-samba-4.13.4-1.el9_9.1.s390x.rpm SHA-256: 21fbad7b3ec919aea986730b0d9987550ac4f19ca77de2c4e8826d6df2a95614
ipa-common-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 8a8c5befe89bda75002b5be89975eff98ccb2dd05a391a5400d48ca4f77c4408
ipa-debuginfo-4.13.4-1.el9_9.1.s390x.rpm SHA-256: 878572b9dbbe55cca95ed54eba20bcd756f296d82fa689611ff77ebfcf5d54ae
ipa-debugsource-4.13.4-1.el9_9.1.s390x.rpm SHA-256: 9674fa39c808726ea92fbc082e5e13f8cd65119b158f05c1f84f0b692e298624
ipa-selinux-4.13.4-1.el9_9.1.noarch.rpm SHA-256: e2fff702abad86f13ac54f42e35f687773420fea0d18b4110b5d6124025456aa
ipa-selinux-luna-4.13.4-1.el9_9.1.noarch.rpm SHA-256: d2bde3058994561af842667df05d27b62276175707411c913181e6792679eda4
ipa-selinux-nfast-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 34cc8b96830acf0f843b487206e3d1908cd9cca54f14991f28568c3814109285
ipa-server-4.13.4-1.el9_9.1.s390x.rpm SHA-256: 5e23da9f7ca24948f38f1fae4b2017fbab5966d04ff3c841f21cfac01e941c54
ipa-server-common-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 9883a2ee5f0b96ee02e4c7369f112a32432a13224969c65a046cf7f936d87751
ipa-server-debuginfo-4.13.4-1.el9_9.1.s390x.rpm SHA-256: 268fce1cc72b6bf903c8f3915c9c982fe758a408a4d191a14ce5b0051066a814
ipa-server-dns-4.13.4-1.el9_9.1.noarch.rpm SHA-256: f0234bb14c6f277641a703879a7fba891188738472de5003b1e64b5d337df2d6
ipa-server-encrypted-dns-4.13.4-1.el9_9.1.s390x.rpm SHA-256: 577c492121fc22e2adeda76048a0ffd436f407748c020d30876a7884dac481d3
ipa-server-trust-ad-4.13.4-1.el9_9.1.s390x.rpm SHA-256: 9e6a68b8fc9719e0dd80d8296b85cced8baa6dd32969ba02d028f67d98e3e651
ipa-server-trust-ad-debuginfo-4.13.4-1.el9_9.1.s390x.rpm SHA-256: 718e87598aea70d2140c4c81e7ce8dc0510a7da9096b5d18809b6c984a8b7616
python3-ipaclient-4.13.4-1.el9_9.1.noarch.rpm SHA-256: ffccab7cc1cfda8ca57f6cc44bb355be888b54ae91437c0b52e41ba1fce2195f
python3-ipalib-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 6b8c4cc87292a13c0e5faff07cb537e4290bee51637a0807ae6358c9f21b80d2
python3-ipaserver-4.13.4-1.el9_9.1.noarch.rpm SHA-256: b853a2863abdb3209f2a2d69c68a907861d0ba19dfb6557ba3a485e8df92d9c4

Red Hat Enterprise Linux for Power, little endian 9

SRPM
ipa-4.13.4-1.el9_9.1.src.rpm SHA-256: c9fdf8b15a4f4be458467a83eb5e6482799f7c0e63407e1c2d9c9a5ed5d35168
ppc64le
ipa-client-4.13.4-1.el9_9.1.ppc64le.rpm SHA-256: d7a39e81771c057660109421ada3561cc19699339e83e31549a6c187185df2bd
ipa-client-common-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 438b6eabfbfe4ba158b9cf60d8d50df82e6dca5d12e9135ac2b9a8c3bb65e352
ipa-client-debuginfo-4.13.4-1.el9_9.1.ppc64le.rpm SHA-256: 9ffc1069c21faf798346bf37c0ac7d4ec3ceedea9b92b32fecf5c7f44e462eaf
ipa-client-encrypted-dns-4.13.4-1.el9_9.1.ppc64le.rpm SHA-256: 33945572b6b176404fd392fcef6ad29413aff10ca9af4e6f60fe3f560150aa4f
ipa-client-epn-4.13.4-1.el9_9.1.ppc64le.rpm SHA-256: 003aba818e702025feb6fe3b5bfb415f3d844a605d659932c2c8457212bbdce6
ipa-client-samba-4.13.4-1.el9_9.1.ppc64le.rpm SHA-256: 0322e26d7bbd2ce2c8e2e099d3b9078838ec17f079d27f0e0b8cd012f030faaf
ipa-common-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 8a8c5befe89bda75002b5be89975eff98ccb2dd05a391a5400d48ca4f77c4408
ipa-debuginfo-4.13.4-1.el9_9.1.ppc64le.rpm SHA-256: c005414ff9f45a86c1ae7d5fa4df6656e18f59b9cb509d1e87b66a41cdcbbb6c
ipa-debugsource-4.13.4-1.el9_9.1.ppc64le.rpm SHA-256: 7769ac8a28e9b5e2b1a3ec7f4e34167563d54eeeb6ffc95033cb8a62b397c68f
ipa-selinux-4.13.4-1.el9_9.1.noarch.rpm SHA-256: e2fff702abad86f13ac54f42e35f687773420fea0d18b4110b5d6124025456aa
ipa-selinux-luna-4.13.4-1.el9_9.1.noarch.rpm SHA-256: d2bde3058994561af842667df05d27b62276175707411c913181e6792679eda4
ipa-selinux-nfast-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 34cc8b96830acf0f843b487206e3d1908cd9cca54f14991f28568c3814109285
ipa-server-4.13.4-1.el9_9.1.ppc64le.rpm SHA-256: e9b097392b1c971c7b9a9b3f16050dad938667c2a9a0740a14e3457786e303d5
ipa-server-common-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 9883a2ee5f0b96ee02e4c7369f112a32432a13224969c65a046cf7f936d87751
ipa-server-debuginfo-4.13.4-1.el9_9.1.ppc64le.rpm SHA-256: 3936e70e3b9398389da54a013b0010392040858ca2d13f1ec9a43e530f16361b
ipa-server-dns-4.13.4-1.el9_9.1.noarch.rpm SHA-256: f0234bb14c6f277641a703879a7fba891188738472de5003b1e64b5d337df2d6
ipa-server-encrypted-dns-4.13.4-1.el9_9.1.ppc64le.rpm SHA-256: d562da0d14b4fb112fb32d88069a691621481251ad4090896058787eab114e45
ipa-server-trust-ad-4.13.4-1.el9_9.1.ppc64le.rpm SHA-256: 37d9f1be902774cdd37be5328a7202ffddde4387f0dea3162401721c1820c16c
ipa-server-trust-ad-debuginfo-4.13.4-1.el9_9.1.ppc64le.rpm SHA-256: c54610dc84838263293544841f6bb4acb39ac5b8d595f7d8978200b538e6762d
python3-ipaclient-4.13.4-1.el9_9.1.noarch.rpm SHA-256: ffccab7cc1cfda8ca57f6cc44bb355be888b54ae91437c0b52e41ba1fce2195f
python3-ipalib-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 6b8c4cc87292a13c0e5faff07cb537e4290bee51637a0807ae6358c9f21b80d2
python3-ipaserver-4.13.4-1.el9_9.1.noarch.rpm SHA-256: b853a2863abdb3209f2a2d69c68a907861d0ba19dfb6557ba3a485e8df92d9c4

Red Hat Enterprise Linux for ARM 64 9

SRPM
ipa-4.13.4-1.el9_9.1.src.rpm SHA-256: c9fdf8b15a4f4be458467a83eb5e6482799f7c0e63407e1c2d9c9a5ed5d35168
aarch64
ipa-client-4.13.4-1.el9_9.1.aarch64.rpm SHA-256: ce210af7d1fb20cc9598b4537d870f6c2cf979461793b4574c570892fc5a890c
ipa-client-common-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 438b6eabfbfe4ba158b9cf60d8d50df82e6dca5d12e9135ac2b9a8c3bb65e352
ipa-client-debuginfo-4.13.4-1.el9_9.1.aarch64.rpm SHA-256: dc797460e02d269a7be45ed8ff30b29630596ed6912bac635b5a28859cd19a2b
ipa-client-encrypted-dns-4.13.4-1.el9_9.1.aarch64.rpm SHA-256: acd056b6834a7c5362f2446633d611342649d7f2c7c21d78df65f58e36183882
ipa-client-epn-4.13.4-1.el9_9.1.aarch64.rpm SHA-256: 6ddf58f20840b0fb853c13f52d8b828103aac0f8b7bed425c263c1529424b23c
ipa-client-samba-4.13.4-1.el9_9.1.aarch64.rpm SHA-256: d7658b4e5a7a4ec5a23164cae3ad364f050fa1a6a572cabff5d198439b9d40e8
ipa-common-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 8a8c5befe89bda75002b5be89975eff98ccb2dd05a391a5400d48ca4f77c4408
ipa-debuginfo-4.13.4-1.el9_9.1.aarch64.rpm SHA-256: 1b708775f0d425debf9cf5f5219788167d05b52805b25dc65dfabe6026286397
ipa-debugsource-4.13.4-1.el9_9.1.aarch64.rpm SHA-256: 0cd2e9df57970f906750e6691a2a72566bde139c469180c778b650a2a855469b
ipa-selinux-4.13.4-1.el9_9.1.noarch.rpm SHA-256: e2fff702abad86f13ac54f42e35f687773420fea0d18b4110b5d6124025456aa
ipa-selinux-luna-4.13.4-1.el9_9.1.noarch.rpm SHA-256: d2bde3058994561af842667df05d27b62276175707411c913181e6792679eda4
ipa-selinux-nfast-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 34cc8b96830acf0f843b487206e3d1908cd9cca54f14991f28568c3814109285
ipa-server-4.13.4-1.el9_9.1.aarch64.rpm SHA-256: 0323a403ac3d6cdb2da771f05cc7bb57492268838f76503ee350d854a4de45e6
ipa-server-common-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 9883a2ee5f0b96ee02e4c7369f112a32432a13224969c65a046cf7f936d87751
ipa-server-debuginfo-4.13.4-1.el9_9.1.aarch64.rpm SHA-256: cc85044aa04478a65a1ca6b814aefa09f1121506ba36add1e7b260c4a61f52ce
ipa-server-dns-4.13.4-1.el9_9.1.noarch.rpm SHA-256: f0234bb14c6f277641a703879a7fba891188738472de5003b1e64b5d337df2d6
ipa-server-encrypted-dns-4.13.4-1.el9_9.1.aarch64.rpm SHA-256: 03e1a14693f68a19a95232ae17512bf7def4b875ae5df42a6c640950973a30c3
ipa-server-trust-ad-4.13.4-1.el9_9.1.aarch64.rpm SHA-256: d8f2cf290a9840756c6fb2fc1619ca87ecf6f3295395877f187edacde110bfd7
ipa-server-trust-ad-debuginfo-4.13.4-1.el9_9.1.aarch64.rpm SHA-256: 4cf32a9296d9d139db3d0122ed5fefd658b0a993bc1b94742ab74a6511c6c195
python3-ipaclient-4.13.4-1.el9_9.1.noarch.rpm SHA-256: ffccab7cc1cfda8ca57f6cc44bb355be888b54ae91437c0b52e41ba1fce2195f
python3-ipalib-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 6b8c4cc87292a13c0e5faff07cb537e4290bee51637a0807ae6358c9f21b80d2
python3-ipaserver-4.13.4-1.el9_9.1.noarch.rpm SHA-256: b853a2863abdb3209f2a2d69c68a907861d0ba19dfb6557ba3a485e8df92d9c4

Red Hat CodeReady Linux Builder for x86_64 9

SRPM
x86_64
python3-ipatests-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 1d443e956bc549d6a5907ef3e21b8434fcf9ded570ee6125e85e17209d0cc801

Red Hat CodeReady Linux Builder for Power, little endian 9

SRPM
ppc64le
python3-ipatests-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 1d443e956bc549d6a5907ef3e21b8434fcf9ded570ee6125e85e17209d0cc801

Red Hat CodeReady Linux Builder for ARM 64 9

SRPM
aarch64
python3-ipatests-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 1d443e956bc549d6a5907ef3e21b8434fcf9ded570ee6125e85e17209d0cc801

Red Hat CodeReady Linux Builder for IBM z Systems 9

SRPM
s390x
python3-ipatests-4.13.4-1.el9_9.1.noarch.rpm SHA-256: 1d443e956bc549d6a5907ef3e21b8434fcf9ded570ee6125e85e17209d0cc801

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.