A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-qrcode-coreUpgrade ipa-server-encrypted-dnsUpgrade ipa-selinux-lunaUpgrade ipa-client-commonUpgrade python3-qrcodeUpgrade softhsmUpgrade slapi-nisUpgrade ipa-server-trust-adUpgrade python3-custodiaUpgrade opendnssecUpgrade softhsm-develUpgrade python3-pyusbUpgrade python3-ipalibUpgrade ipa-selinux-nfastUpgrade ipa-server-commonUpgrade ipa-clientUpgrade python3-ipaclientUpgrade ipa-client-sambaUpgrade bind-dyndb-ldapUpgrade python3-yubicoUpgrade python3-jwcryptoUpgrade python3-ipatestsUpgrade ipa-serverUpgrade ipa-commonUpgrade python3-ipaserverUpgrade custodiaUpgrade ipa-client-encrypted-dnsUpgrade ipa-client-epnUpgrade ipa-selinuxUpgrade ipa-healthcheck | Oct 11, 2026 | Sep 23, 2026 |
| Freebsd | — | Upgrade freeipa-server | Sep 18, 2026 | Sep 11, 2026 |
| Oracle_linux | — | Upgrade bind-dyndb-ldapUpgrade python3-jwcryptoUpgrade ipa-client-commonUpgrade python3-ipaclientUpgrade ipa-healthcheck-coreUpgrade python3-qrcodeUpgrade custodiaUpgrade ipa-client-sambaUpgrade ipa-server-commonUpgrade python3-ipaserverUpgrade ipa-server-dnsUpgrade ipa-healthcheckUpgrade ipa-selinuxUpgrade ipa-client-encrypted-dnsUpgrade python3-qrcode-coreUpgrade ipa-commonUpgrade ipa-clientUpgrade softhsmUpgrade python3-kdcproxyUpgrade python3-ipalibUpgrade python3-yubicoUpgrade slapi-nisUpgrade python3-pyusbUpgrade python3-custodiaUpgrade ipa-server-encrypted-dnsUpgrade softhsm-develUpgrade python3-ipatestsUpgrade ipa-server-trust-adUpgrade ipa-selinux-lunaUpgrade opendnssecUpgrade ipa-serverUpgrade ipa-selinux-nfastUpgrade ipa-python-compatUpgrade ipa-client-epn | Oct 22, 2026 | Sep 7, 2026 |
| Redhat_linux | — | Upgrade ipa-debuginfoUpgrade bind-dyndb-ldap-debuginfoNo solution existsUpgrade ipa-client-encrypted-dnsUpgrade python3-yubicoUpgrade ipa-selinux-nfastUpgrade opendnssec-debuginfoUpgrade ipa-commonUpgrade ipa-server-trust-adUpgrade python3-qrcode-coreUpgrade ipa-debugsourceUpgrade ipa-client-commonUpgrade opendnssecUpgrade python3-custodiaUpgrade ipa-client-epnUpgrade python3-pyusbUpgrade slapi-nisUpgrade ipa-selinux-lunaUpgrade ipa-server-encrypted-dnsUpgrade ipa-server-debuginfoUpgrade softhsmUpgrade slapi-nis-debuginfoUpgrade slapi-nis-debugsourceUpgrade softhsm-develUpgrade python3-ipaserverUpgrade ipa-clientUpgrade ipa-python-compatUpgrade ipa-serverUpgrade python3-qrcodeUpgrade softhsm-debuginfoUpgrade ipa-server-dnsUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-selinuxUpgrade ipa-client-debuginfoUpgrade python3-ipatestsUpgrade opendnssec-debugsourceUpgrade bind-dyndb-ldapUpgrade ipa-healthcheck-coreUpgrade python3-kdcproxyUpgrade python3-ipaclientUpgrade ipa-healthcheckUpgrade softhsm-debugsourceUpgrade ipa-client-sambaUpgrade python3-jwcryptoUpgrade custodiaUpgrade ipa-server-commonUpgrade python3-ipalibUpgrade bind-dyndb-ldap-debugsource | Sep 9, 2026 | Sep 7, 2026 |
| Rocky_linux | — | Upgrade bind-dyndb-ldap-debuginfoUpgrade slapi-nis-debuginfoUpgrade bind-dyndb-ldapUpgrade opendnssec-debugsourceUpgrade ipa-server-trust-adUpgrade ipa-client-sambaUpgrade ipa-server-trust-ad-debuginfoUpgrade bind-dyndb-ldap-debugsourceUpgrade softhsm-debuginfoUpgrade softhsm-debugsourceUpgrade ipa-client-debuginfoUpgrade slapi-nisUpgrade ipa-client-encrypted-dnsUpgrade ipa-server-debuginfoUpgrade ipa-serverUpgrade opendnssec-debuginfoUpgrade slapi-nis-debugsourceUpgrade ipa-server-encrypted-dnsUpgrade ipa-client-epnUpgrade ipa-clientUpgrade softhsm-develUpgrade opendnssecUpgrade softhsmUpgrade ipa-debugsourceUpgrade ipa-debuginfo | Sep 28, 2026 | Sep 24, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub