A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-selinux-nfastUpgrade ipa-server-dnsUpgrade ipa-healthcheck-coreUpgrade python3-qrcode-coreUpgrade ipa-selinux-lunaUpgrade ipa-server-trust-adUpgrade python3-qrcodeUpgrade slapi-nisUpgrade ipa-server-commonUpgrade python3-ipalibUpgrade softhsm-develUpgrade opendnssecUpgrade ipa-client-commonUpgrade softhsmUpgrade python3-kdcproxyUpgrade ipa-python-compatUpgrade ipa-server-encrypted-dnsUpgrade python3-custodiaUpgrade python3-pyusbUpgrade ipa-serverUpgrade custodiaUpgrade ipa-commonUpgrade python3-ipaclientUpgrade ipa-clientUpgrade python3-ipaserverUpgrade python3-ipatestsUpgrade ipa-client-encrypted-dnsUpgrade ipa-selinuxUpgrade bind-dyndb-ldapUpgrade python3-yubicoUpgrade ipa-healthcheckUpgrade ipa-client-epnUpgrade python3-jwcryptoUpgrade ipa-client-samba | Oct 11, 2026 | Sep 23, 2026 |
| Freebsd | — | Upgrade freeipa-server | Sep 18, 2026 | Sep 11, 2026 |
| Redhat_linux | — | Upgrade ipa-client-sambaUpgrade python3-ipaclientUpgrade python3-ipatestsUpgrade bind-dyndb-ldap-debugsourceUpgrade bind-dyndb-ldapUpgrade softhsm-debuginfoUpgrade ipa-server-dnsUpgrade ipa-healthcheckUpgrade opendnssec-debugsourceUpgrade python3-qrcodeUpgrade ipa-client-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade python3-kdcproxyUpgrade ipa-selinuxUpgrade ipa-healthcheck-coreUpgrade python3-ipalibUpgrade python3-jwcryptoUpgrade softhsm-debugsourceUpgrade custodiaUpgrade ipa-server-commonUpgrade opendnssec-debuginfoUpgrade ipa-debuginfoUpgrade ipa-serverUpgrade slapi-nisUpgrade python3-qrcode-coreUpgrade python3-pyusbUpgrade slapi-nis-debuginfoUpgrade ipa-python-compatUpgrade slapi-nis-debugsourceUpgrade python3-yubicoNo solution existsUpgrade ipa-server-debuginfoUpgrade softhsm-develUpgrade ipa-selinux-nfastUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-client-epnUpgrade opendnssecUpgrade ipa-server-encrypted-dnsUpgrade ipa-debugsourceUpgrade softhsmUpgrade python3-ipaserverUpgrade ipa-client-encrypted-dnsUpgrade ipa-selinux-lunaUpgrade ipa-client-commonUpgrade ipa-clientUpgrade ipa-server-trust-adUpgrade python3-custodiaUpgrade ipa-common | Sep 9, 2026 | Sep 7, 2026 |
| Rocky_linux | — | Upgrade ipa-client-debuginfoUpgrade bind-dyndb-ldapUpgrade softhsm-debugsourceUpgrade ipa-server-trust-ad-debuginfoUpgrade softhsm-develUpgrade ipa-debugsourceUpgrade ipa-debuginfoUpgrade ipa-clientUpgrade ipa-client-encrypted-dnsUpgrade softhsmUpgrade slapi-nis-debugsourceUpgrade slapi-nisUpgrade ipa-client-epnUpgrade ipa-server-debuginfoUpgrade ipa-serverUpgrade opendnssec-debuginfoUpgrade ipa-server-encrypted-dnsUpgrade opendnssecUpgrade bind-dyndb-ldap-debugsourceUpgrade softhsm-debuginfoUpgrade opendnssec-debugsourceUpgrade ipa-client-sambaUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-server-trust-adUpgrade slapi-nis-debuginfo | Sep 28, 2026 | Sep 24, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub