Name: CVE-2026-13097: Use of Incorrectly-Resolved Name or Reference
Creator: Rapid7
Published: 2026-08-20T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-13097, CWE-706, CVSS 8.7, EPSS 0.0057

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

CVSS Details

CVSS 3.1 Base Score: 8.7
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade ipa-client-sambaUpgrade python3-ipaserverUpgrade ipa-client-epnUpgrade ipa-server-commonUpgrade ipa-selinuxUpgrade ipa-client-encrypted-dnsUpgrade ipa-commonUpgrade python3-ipatestsUpgrade ipa-server-encrypted-dnsUpgrade ipa-clientUpgrade ipa-serverUpgrade python3-ipaclientUpgrade ipa-server-dnsUpgrade ipa-selinux-nfastUpgrade ipa-selinux-lunaUpgrade ipa-server-trust-adUpgrade ipa-client-commonUpgrade python3-ipalib	Oct 11, 2026	Sep 23, 2026
Freebsd	—	Upgrade freeipa-server	Sep 18, 2026	Sep 11, 2026
Redhat_linux	—	Upgrade ipa-client-commonUpgrade ipa-python-compatUpgrade python3-kdcproxyUpgrade ipa-debuginfoUpgrade python3-ipaclientUpgrade opendnssec-debugsourceUpgrade python3-jwcryptoUpgrade python3-qrcodeUpgrade ipa-server-dnsUpgrade ipa-client-sambaUpgrade softhsmUpgrade ipa-client-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade opendnssecUpgrade python3-ipalibUpgrade ipa-server-commonUpgrade custodiaUpgrade python3-qrcode-coreUpgrade python3-pyusbUpgrade softhsm-develUpgrade ipa-serverUpgrade ipa-clientUpgrade ipa-server-encrypted-dnsUpgrade softhsm-debugsourceUpgrade bind-dyndb-ldapUpgrade ipa-server-trust-adNo solution existsUpgrade ipa-server-debuginfoUpgrade ipa-client-epnUpgrade opendnssec-debuginfoUpgrade ipa-healthcheckUpgrade bind-dyndb-ldap-debugsourceUpgrade python3-ipatestsUpgrade python3-custodiaUpgrade python3-ipaserverUpgrade softhsm-debuginfoUpgrade ipa-selinux-nfastUpgrade ipa-commonUpgrade ipa-selinux-lunaUpgrade python3-yubicoUpgrade ipa-debugsourceUpgrade slapi-nisUpgrade slapi-nis-debuginfoUpgrade ipa-healthcheck-coreUpgrade ipa-client-encrypted-dnsUpgrade ipa-server-trust-ad-debuginfoUpgrade slapi-nis-debugsourceUpgrade ipa-selinux	Aug 24, 2026	Aug 20, 2026
Rocky_linux	—	Upgrade ipa-client-epnUpgrade ipa-server-encrypted-dnsUpgrade ipa-debuginfoUpgrade ipa-client-sambaUpgrade ipa-server-debuginfoUpgrade ipa-client-debuginfoUpgrade ipa-clientUpgrade ipa-debugsourceUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-client-encrypted-dnsUpgrade ipa-server-trust-adUpgrade ipa-server	Sep 28, 2026	Sep 24, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence