Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-20T10:19:07 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N CWE-706

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

This bug can only be used if the user already has access to the LDAP to a computer account or an account with the right to add to almost any branch of the LDAP directory. Also this bug can be used to corrupt the LDAP privileges but can not be used to launch a Denial of Service since LDAP privileges do not generally coincide with system privileges. Red Hat would like to thank Vladislav Plyatsok (rd01f) for reporting this issue. Red Hat Enterprise Linux 10 Affected ipa Red Hat Enterprise Linux 6 Out of support scope ipa Red Hat Enterprise Linux 7 Affected ipa Red Hat Enterprise Linux 8 Affected idm:client/ipa Red Hat Enterprise Linux 8 Affected idm:DL1/ipa Red Hat Enterprise Linux 8 Affected ipa Red Hat Enterprise Linux 9 Affected ipa https://www.cve.org/CVERecord?id=CVE-2026-13097 https://nvd.nist.gov/vuln/detail/CVE-2026-13097