CVE-2026-11861
CVE-2026-11861 · Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.
CVSS 9.6 · Critical · EPSS 0.4%
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
- Versions
- ≥ 0:4.13.4-1.el10_2: Not affected (rpm)
No fix published
red hat enterprise linux 10.0 extended update support
- Versions
- ≥ 0:4.12.2-15.el10_0.7: Not affected (rpm)
No fix published
red hat enterprise linux 8
- Versions
- ≥ 8100020261007071200.143e9e98: Not affected (rpm)
No fix published
red hat enterprise linux 8
- Versions
- ≥ 8100020261007070536.823393f5: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 telecommunications update service
- Versions
- ≥ 8080020261007080925.e581a9e4: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 telecommunications update service
- Versions
- ≥ 8080020261007071832.b0a6ceea: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 update services for sap solutions
- Versions
- ≥ 8080020261007080925.e581a9e4: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 update services for sap solutions
- Versions
- ≥ 8080020261007071832.b0a6ceea: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:4.13.4-1.el9_8: Not affected (rpm)
No fix published
red hat enterprise linux 9.2 update services for sap solutions
- Versions
- ≥ 0:4.10.1-12.el9_2.7: Not affected (rpm)
No fix published
red hat enterprise linux 9.4 update services for sap solutions
- Versions
- ≥ 0:4.11.0-15.el9_4.9: Not affected (rpm)
No fix published
red hat enterprise linux 9.6 extended update support
- Versions
- ≥ 0:4.12.2-14.el9_6.8: Not affected (rpm)
No fix published
red hat enterprise linux 6
No fix published
red hat enterprise linux 7
No fix published
freeipa Debian:12
- Versions
- 4.10.1+dfsg1-1+exp1
- 4.10.1-1+exp1
- 4.10.2-1
- 4.10.2-2
- 4.10.2-2+exp1
- 4.11.1-1
- 4.11.1-1+exp1
- 4.11.1-2
- 4.11.1-2+exp1
- 4.11.1-2.1
- 4.12.2-1
- 4.12.2-2
- 4.12.2-3
- 4.12.4-1
- 4.12.4-2
- 4.13.1-1
- 4.9.11-1
- 4.9.11-1+exp1
- 4.9.11-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Debian:13
- Versions
- 4.12.4-1
- 4.12.4-2
- 4.13.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:Pro:14.04:LTS
- Versions
- 3.2.1-0ubuntu1
- 3.3.4-0ubuntu1
- 3.3.4-0ubuntu2
- 3.3.4-0ubuntu3
- 3.3.4-0ubuntu3.1
- 3.3.4-0ubuntu3.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:Pro:16.04:LTS
- Versions
- 4.1.4-1
- 4.3.1-0ubuntu1
- 4.3.1-0ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:18.04:LTS
- Versions
- 4.4.4-3ubuntu1
- 4.4.4-4
- 4.7.0~pre1+git20180411-2ubuntu1
- 4.7.0~pre1+git20180411-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:20.04:LTS
- Versions
- 4.8.1-2ubuntu1
- 4.8.3-1
- 4.8.6-1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:22.04:LTS
- Versions
- 4.8.6-1ubuntu6
- 4.8.6-1ubuntu8
- 4.8.6-1ubuntu9
- 4.9.8-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:24.04:LTS
- Versions
- 4.10.2-1
- 4.10.2-2
- 4.10.2-2ubuntu3
- 4.11.1-1
- 4.11.1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:26.10
- Versions
- 4.13.1-1
- 4.13.1-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:26.04:LTS
- Versions
- 4.12.4-1
- 4.12.4-2
- 4.13.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://access.redhat.com/errata/RHSA-2026:70564
- https://access.redhat.com/errata/RHSA-2026:72279
- https://access.redhat.com/errata/RHSA-2026:82935
- https://access.redhat.com/errata/RHSA-2026:83083
- https://access.redhat.com/errata/RHSA-2026:83084
- https://access.redhat.com/errata/RHSA-2026:83085
- https://access.redhat.com/errata/RHSA-2026:83460
- https://access.redhat.com/errata/RHSA-2026:83461
- https://access.redhat.com/security/cve/CVE-2026-11861
- https://bugzilla.redhat.com/show_bug.cgi?id=2487472
- https://nvd.nist.gov/vuln/detail/CVE-2026-11861