Privilege Escalation Flaw in FreeIPA by Red Hat
CVE-2026-13097

8.7HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Vendor
CVE Published:
20 August 2026

What is CVE-2026-13097?

A flaw exists in FreeIPA where the uniqueness constraint for Kerberos principal name attributes in the 389-ds directory server fails to correctly consider equivalent representations of the same principal name. This improperly enforced constraint allows a user with sufficient LDAP write permissions to create a service principal that can impersonate an existing privileged principal. Consequently, this can lead to the unauthorized acquisition of Kerberos service tickets for sensitive services, paving the way for potential full domain compromise.

Affected Version(s)

Red Hat Enterprise Linux 10 0:4.13.4-1.el10_2

Red Hat Enterprise Linux 10.0 Extended Update Support 0:4.12.2-15.el10_0.7

Red Hat Enterprise Linux 8 8100020261007071200.143e9e98

References

https://access.redhat.com/errata/RHSA-2026:70564
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:72279
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:82935
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Vladislav Plyatsok (rd01f) for reporting this issue.
.