CVE-2026-13097
CVE-2026-13097 · Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.
CVSS 8.7 · High · EPSS 0.6%
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
- Versions
- ≥ 0:4.13.4-1.el10_2: Not affected (rpm)
No fix published
red hat enterprise linux 10.0 extended update support
- Versions
- ≥ 0:4.12.2-15.el10_0.7: Not affected (rpm)
No fix published
red hat enterprise linux 8
- Versions
- ≥ 8100020261007071200.143e9e98: Not affected (rpm)
No fix published
red hat enterprise linux 8
- Versions
- ≥ 8100020261007070536.823393f5: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 telecommunications update service
- Versions
- ≥ 8080020261007080925.e581a9e4: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 telecommunications update service
- Versions
- ≥ 8080020261007071832.b0a6ceea: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 update services for sap solutions
- Versions
- ≥ 8080020261007080925.e581a9e4: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 update services for sap solutions
- Versions
- ≥ 8080020261007071832.b0a6ceea: Not affected (rpm)
No fix published
red hat enterprise linux 9
- Versions
- ≥ 0:4.13.4-1.el9_8: Not affected (rpm)
No fix published
red hat enterprise linux 9.2 update services for sap solutions
- Versions
- ≥ 0:4.10.1-12.el9_2.7: Not affected (rpm)
No fix published
red hat enterprise linux 9.4 update services for sap solutions
- Versions
- ≥ 0:4.11.0-15.el9_4.9: Not affected (rpm)
No fix published
red hat enterprise linux 9.6 extended update support
- Versions
- ≥ 0:4.12.2-14.el9_6.8: Not affected (rpm)
No fix published
red hat enterprise linux 6
No fix published
red hat enterprise linux 7
No fix published
red hat enterprise linux 8
No fix published
freeipa Debian:12
- Versions
- 4.10.1+dfsg1-1+exp1
- 4.10.1-1+exp1
- 4.10.2-1
- 4.10.2-2
- 4.10.2-2+exp1
- 4.11.1-1
- 4.11.1-1+exp1
- 4.11.1-2
- 4.11.1-2+exp1
- 4.11.1-2.1
- 4.12.2-1
- 4.12.2-2
- 4.12.2-3
- 4.12.4-1
- 4.12.4-2
- 4.13.1-1
- 4.9.11-1
- 4.9.11-1+exp1
- 4.9.11-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Debian:13
- Versions
- 4.12.4-1
- 4.12.4-2
- 4.13.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:Pro:14.04:LTS
- Versions
- 3.2.1-0ubuntu1
- 3.3.4-0ubuntu1
- 3.3.4-0ubuntu2
- 3.3.4-0ubuntu3
- 3.3.4-0ubuntu3.1
- 3.3.4-0ubuntu3.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:Pro:16.04:LTS
- Versions
- 4.1.4-1
- 4.3.1-0ubuntu1
- 4.3.1-0ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:18.04:LTS
- Versions
- 4.4.4-3ubuntu1
- 4.4.4-4
- 4.7.0~pre1+git20180411-2ubuntu1
- 4.7.0~pre1+git20180411-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:20.04:LTS
- Versions
- 4.8.1-2ubuntu1
- 4.8.3-1
- 4.8.6-1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:22.04:LTS
- Versions
- 4.8.6-1ubuntu6
- 4.8.6-1ubuntu8
- 4.8.6-1ubuntu9
- 4.9.8-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:24.04:LTS
- Versions
- 4.10.2-1
- 4.10.2-2
- 4.10.2-2ubuntu3
- 4.11.1-1
- 4.11.1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Ubuntu:26.10
- Versions
- 4.13.1-1
- 4.13.1-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://access.redhat.com/errata/RHSA-2026:70564
- https://access.redhat.com/errata/RHSA-2026:72279
- https://access.redhat.com/errata/RHSA-2026:82935
- https://access.redhat.com/errata/RHSA-2026:83083
- https://access.redhat.com/errata/RHSA-2026:83084
- https://access.redhat.com/errata/RHSA-2026:83085
- https://access.redhat.com/errata/RHSA-2026:83460
- https://access.redhat.com/errata/RHSA-2026:83461
- https://access.redhat.com/security/cve/CVE-2026-13097
- https://bugzilla.redhat.com/show_bug.cgi?id=2515974
- https://nvd.nist.gov/vuln/detail/CVE-2026-13097