version 4.13.4

www.freeipa.org • September 8, 2026

It can be downloaded from . Builds for Fedora distributions will be available from the official repository soon.

Highlights in 4.13.4 #

CVE-2026-79678: idp-add eval() reachable before authorization check allows environment disclosure and denial of service #

A flaw was found in FreeIPA’s idp-add command. ipapython.ipautil.template_str() evaluates any eval(…) token found in a post-substitution string using Python’s eval() . ipaserver/plugins/idp.py passes the caller-supplied –organization and –base-url values ( ipaidporg / ipaidpbaseurl ), which have no input validation, into this function via provider templates (okta, keycloak, microsoft). The LDAPCreate command framework runs this evaluation inside pre_callback , before the LDAP access control check that restricts idp-add to the ‘External IdP server Administrators’ privilege is ever evaluated. As a result, any authenticated IPA principal, regardless of privilege level, can trigger this evaluation.

Callbacks such as pre_callback run by the IPA API LDAP framework automatically. The fix is to apply permissions and ACIs checks to the authenticated IPA principal before any callbacks are executed.

This report prompted us to look at the overall access control checks in IPA API LDAP framework use. To fix similar issues in the framework overall, on top of LDAP access controls, we added an access control check to all IPA API operations. These checks take both ACL sources into account:

managed permissions defined in IPA plugins implicit LDAP ACIs defined in LDAP

managed permissions defined in IPA plugins

implicit LDAP ACIs defined in LDAP

Managed permissions are associated with each LDAP object in IPA API and represent IPA API permissions and the privileges they can bear. Privileges associated with managed permissions are visible to administrators and membership can be added to grant permissions to administrators. The privileges converted into LDAP ACIs at runtime and updated every time new FreeIPA code is deployed.

CVE-2026-76578: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI #

Due to a bug in 389-ds directory server’s implementation of access controls, an unauthenticated LDAP client (anonymous bind or SASL ANONYMOUS) can create a self-managed OTP token entry with empty ipaTokenOwner/managedBy attributes, which satisfy 389 Directory Server’s SELFDN ACI evaluator against the anonymous bind’s own empty DN (see companion 389-ds flaw for that underlying defect). FreeIPA’s self-managed-token ACI (install/ /default-aci.ldif) does not restrict which other attributes may be added, allowing the client to inject an arbitrary attacker-chosen Kerberos principal that does not yet exist in the LDAP database. Mitigations introduced for CVE-2026-13097 fix does not allow overtaking existing accounts.

The attack may be used as a stepping stone to take over administrative privileges. Additional access controls hardening was applied to prevent follow up activities to elevate state of acquired credentials to administrative ones.

In order to address this vulnerability, FreeIPA and 389-ds teams had to review existing access controls implementation in both projects. On FreeIPA side the team chose to tighten up permissions guarding self-management access: the bare userdn = “ldap:///self” bind rule was replaced with (userdn = “ldap:///self” and userdn = “ldap:///all”) bind rule. The latter ensures that any user DN in an active LDAP bind matching the ldap:///self is also an authenticated one (e.g. ldap:///all ). In anonymous LDAP binds the userdn is an empty string that cannot match ldap:///all

FreeIPA 4.13.4 is a stabilization release for the features delivered as a part of 4.13 version series.

There are multiple bug-fixes since FreeIPA 4.13.3 release. Details of the bug-fixes can be seen in the list of resolved tickets below.

Upgrade instructions are available on Upgrade page.

Please provide , bugs and other feedback via the freeipa-users mailing list ( ) or #freeipa channel on libera.chat.

Detailed changelog since 4.13.3 #

Alexander Bokovoy (35) #

vault: fix linting issues commit

vault: document why vaultconfig_show is intentionally ungated commit

cert: authorize certificate retrieval before reaching the RA agent commit

ca, certprofile: require CA Administrator before RA-agent changes commit

certmap: require privilege before matching certificates via SSSD commit

trust: require Replication Administrators before refreshing trust topology commit

baseldap: fall back to effective rights when enforcing managed permissions commit

admins: grant admins group all default privileges commit

trust_add: require Replication Administrators privilege commit

baseldap: force permission checks in LDAP-oriented operations commit

tests: xmlrpc: cover the permission authentication checks commit

tests: xmlrpc: expect the hardened self-service ACIs commit

tests: ipalib: cover parsing of absolute denies and compound bind rules commit

aci: regenerate ACI.txt for the permission changes commit

install: register the new 21-* ACI update scripts commit

aci: convert the self-service ACIs to the hardened bind rule on upgrade commit

aci: use the hardened self-service bind rule in the upgrade ACIs commit

aci: deny anonymous SID reads in the upgrade update commit

aci: deny all anonymous modifications in the upgrade update commit

aci: key the anonymous denies on the empty DN; harden the self-service rules commit

aci: generate the hardened self-service bind rule commit

aci: parse absolute denies and compound bind rules commit

otp: constrain the self-managed-token ADD to OTP object classes commit

trusts: scope Samba ipaNTHash ACI to cn=accounts commit

host: exclude ipaservers from delegated host-write permissions commit

group: read the SID only when authenticated; exclude protected groups from delegated writes commit

stageuser: exclude privileged accounts from delegated credential writes commit

user: read the SID only when authenticated; exclude privileged accounts from delegated writes commit

permission: require an authenticated bind for modification permissions commit

ipa-pwd-extop: fail closed if password metadata cannot be written commit

certprofile: reject import of profiles that can execute programs commit

kdb: enforce CNAME comparison against ipaOriginalUid in ID overrides commit #10041

Principal: implicitly convert to Principal for comparison commit

ipatests: Fix expectations in test_i18n_messages_valid commit

doc: update API change for principal from Str to Principal commit

Spec file: bump samba version to 4.23.11 for Fedora < 44 commit

ipatests: Add ipa-getcert start-tracking tests commit #9968

Rafael Guterres Jeffman (1) #

Back to git snapshots commit

Stanislav Levin (1) #

installer: check all the required PKI ports commit #7415 #10036

ipatests: Fixes for ds-migration testsuite. commit #10029

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical FreeIPA Vulnerabilities Allow Unauthenticated Admin Access A critical flaw in FreeIPA, tracked as CVE-2026-76578, allows unauthenticated clients to create Kerberos identities and gain administrative privileges. This vulnerability arises from a misconfigured access control rule in FreeIPA's 389 Directory Server, enabling attackers to exploit it without prior authentication. Red Hat confirmed that this flaw can be exploited on default installations, allowing remote attackers to perform administrative operations. The vulnerability has a CVSS score of 9.8, indicating its critical nature. A related flaw, CVE-2026-13097, was previously addressed but did not fix the underlying unauthenticated write access issue. Red Hat has released a patch for FreeIPA version 4.13.4 to mitigate this risk. Organizations using FreeIPA should restrict LDAP service access and apply the latest patches immediately. The vulnerabilities primarily affect FreeIPA deployments that expose LDAP to untrusted networks. 3 sources 78

Extracted Entities

version 4.13.4

The full story

Extracted Entities

Companies (3)

CVEs (3)

CWE Weaknesses (4)

Platforms (4)