FreeIPA Security Update Patches Seven Vulnerabilities Including Privilege Escalation and DoS Flaws
FreeIPA version 4.13.3 has been released to address seven security vulnerabilities affecting identity management deployments, including critical privilege escalation flaws and multiple denial of service vectors. The vulnerabilities impact organizations running FreeIPA with Active Directory trust relationships and expose authentication bypass, credential impersonation, and service disruption risks. CVE-2026-11861 allows authenticated Active Directory users to bypass FreeIPA authentication through TGS impersonation when trust relationships exist, while CVE-2026-13097 enables privilege escalation through manipulation of Kerberos principal names. Additional vulnerabilities include four denial of service flaws (CVE-2026-73196, CVE-2026-73197, CVE-2026-73198, CVE-2026-73199) and CVE-2026-19550, which permits unauthorized trust topology manipulation.
The most severe flaw, CVE-2026-11861, exploits insufficient Privilege Attribute Certificate validation in cross-realm trust configurations between FreeIPA and Active Directory. Attackers with valid Active Directory credentials can impersonate client names in Ticket Granting Service requests, bypassing authentication for Web UI, API, SMB, and LDAP services. The attack requires the ability to register duplicate Service Principal Names in Active Directory, a prerequisite Microsoft mitigated in Windows Server 2012 R2 with KB-3070083 and by default in Windows 11 22H2, making the vulnerability primarily relevant to environments with outdated Active Directory infrastructure. CVE-2026-13097 exploits realm-unaware uniqueness enforcement in the 389-ds directory server, allowing users with LDAP write privileges to create service principals that impersonate privileged accounts, potentially leading to full domain compromise. The denial of service vulnerabilities operate through unbounded resource consumption: CVE-2026-73196 processes oversized OTP keys without size limits, CVE-2026-73197 and CVE-2026-73198 allow unauthenticated attackers to submit arbitrarily large request bodies to migration and internationalization endpoints, and CVE-2026-73199 triggers null pointer dereferences through malformed LDAP extended operations.
These vulnerabilities represent significant exposure for organizations using FreeIPA in enterprise identity management architectures, particularly those maintaining Active Directory trust relationships. According to FIRST EPSS data, CVE-2026-13097, CVE-2026-73197, CVE-2026-73198, and CVE-2026-73199 each have a 0.3% probability of exploitation within 30 days, while CVE-2026-11861, CVE-2026-73196, and CVE-2026-19550 each have a 0.2% probability. The privilege escalation paths enable attackers to move from low-privilege authenticated positions to full administrative control, while the denial of service vectors provide both authenticated and unauthenticated attack surfaces. The trust-related vulnerabilities are particularly concerning for hybrid cloud environments where FreeIPA serves as the identity bridge between Linux infrastructure and Windows Active Directory domains. Organizations running FreeIPA versions prior to 4.13.3 face exposure across authentication bypass, credential theft, privilege escalation, and service availability dimensions, with the authentication bypass and privilege escalation flaws presenting the most severe risk to confidentiality and integrity.
Attack Surface
Infrastructure, System Management Service, Web Application
Tactics
Privilege Escalation, Credential Access, Defense Evasion, Impact
Techniques
- T1078 – Valid Accounts
- T1134 – Access Token Manipulation
- T1558 – Steal or Forge Kerberos Tickets
- T1499 – Endpoint Denial of Service
- T1495 – Firmware Corruption
SuperPRO's Threat Countermeasures Procedures
- Upgrade FreeIPA to version 4.13.3 which patches CVE-2026-11861, CVE-2026-13097, CVE-2026-73196, CVE-2026-73197, CVE-2026-73198, CVE-2026-73199, and CVE-2026-19550
- Verify Active Directory domain controllers are patched with Microsoft KB-3070083 for Windows Server 2012 R2 or running Windows 11 22H2 or later to enforce SPN and UPN uniqueness constraints that block CVE-2026-11861 exploitation
- Audit LDAP write privileges to identify users who can create service principals, as CVE-2026-13097 requires LDAP write access to manipulate krbCanonicalName attributes
- Implement RequestReadTimeout directives in HTTPd configuration to limit request body sizes and mitigate CVE-2026-73197 and CVE-2026-73198 unbounded memory consumption
- Monitor for anomalous invocations of trust-fetch-domains command by non-privileged users, as CVE-2026-19550 allows any authenticated user to trigger root-owned oddjobd helpers
- Review trust relationship configurations between FreeIPA and Active Directory, particularly in environments where AD infrastructure is not fully patched or running older functional levels
- Validate that PAC content verification is functioning correctly in cross-realm trust scenarios by testing service ticket acquisition for privileged services
