A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.

alma_linux ALSA-2026:70564: ALSA-2026:70564: ipa security, bug fix, and enhancement update (Critical)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_72279 advisory.

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)

    * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)

    * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)

    * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)

    * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement     in FreeIPA LDAP datastore (CVE-2026-13097)

    * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)

    * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure     and denial of service (CVE-2026-79678)

    Bug Fix(es) and Enhancement(s):

    * [Cursor Automated] Include latest fixes in python3-ipatests package [Rocky Linux10.2] (JIRA:Rocky     Linux-173375)

    * WebUI Hardening [rhel-10.2.z] (JIRA:Rocky Linux-238510)

    * ipa-otptoken-import hardening [rhel-10.2.z] (JIRA:Rocky Linux-238518)

    * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z] (JIRA:Rocky     Linux-238522)

    *  ipa env: support only simple * wildcard [rhel-10.2.z] (JIRA:Rocky Linux-238526)

    * ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z] (JIRA:Rocky Linux-238673)

    * ipa-migrate: require Replication Administrator privilege [rhel-10.2.z] (JIRA:Rocky Linux-238676)

    * ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z] (JIRA:Rocky     Linux-240768)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_70564 advisory.

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)

    * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)

    * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)

    * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)

    * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement     in FreeIPA LDAP datastore (CVE-2026-13097)

    * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)

    * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure     and denial of service (CVE-2026-79678)

    Bug Fix(es) and Enhancement(s):

    * [Cursor Automated] Include latest fixes in python3-ipatests package [Rocky Linux9.8] (JIRA:Rocky     Linux-170987)

    * WebUI Hardening [rhel-9.8.z] (JIRA:Rocky Linux-238511)

    * ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:Rocky Linux-238519)

    * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z] (JIRA:Rocky     Linux-238523)

    * ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:Rocky Linux-238527)

    * ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:Rocky Linux-238674)

    * ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:Rocky Linux-238677)

    * ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z] (JIRA:Rocky     Linux-240767)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:72279 advisory.

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)
      * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)
      * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)
      * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)
      * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)
      * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness     enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
      * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)
      * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment     disclosure and denial of service (CVE-2026-79678)


    Bug Fix(es) and Enhancement(s):

      * [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux10.2]     (JIRA:AlmaLinux-173375)
      * WebUI Hardening [almalinux-10.2.z] (JIRA:AlmaLinux-238510)
      * ipa-otptoken-import hardening [almalinux-10.2.z] (JIRA:AlmaLinux-238518)
      * host-mod: handle the password attribute when set with --setattr userpassword= [almalinux-10.2.z]     (JIRA:AlmaLinux-238522)
      * ipa env: support only simple * wildcard [almalinux-10.2.z] (JIRA:AlmaLinux-238526)
      * ipa-epn: drop_privileges method is mixing uid and gid [almalinux-10.2.z] (JIRA:AlmaLinux-238673)
      * ipa-migrate: require Replication Administrator privilege [almalinux-10.2.z] (JIRA:AlmaLinux-238676)
      * ipa-migrate tool is renaming host records & host info in automount information [almalinux-10.2.z]     (JIRA:AlmaLinux-240768)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:72279 advisory.

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)

    * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)

    * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)

    * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)

    * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement     in FreeIPA LDAP datastore (CVE-2026-13097)

    * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)

    * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure     and denial of service (CVE-2026-79678)

    Bug Fix(es) and Enhancement(s):

    * [Cursor Automated] Include latest fixes in python3-ipatests package [Rocky Linux10.2] (JIRA:Rocky     Linux-173375)

    * WebUI Hardening [rhel-10.2.z] (JIRA:Rocky Linux-238510)

    * ipa-otptoken-import hardening [rhel-10.2.z] (JIRA:Rocky Linux-238518)

    * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z] (JIRA:Rocky     Linux-238522)

    *  ipa env: support only simple * wildcard [rhel-10.2.z] (JIRA:Rocky Linux-238526)

    * ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z] (JIRA:Rocky Linux-238673)

    * ipa-migrate: require Replication Administrator privilege [rhel-10.2.z] (JIRA:Rocky Linux-238676)

    * ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z] (JIRA:Rocky     Linux-240768)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1928:05 advisory.

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)
      * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)
      * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)
      * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)
      * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)
      * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness     enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
      * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)
      * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment     disclosure and denial of service (CVE-2026-79678)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3950 advisory.

    A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting     (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a     specially crafted link and complete a password reset, the attacker could inject and execute arbitrary     JavaScript code. This allows the attacker to perform actions within the victim's authenticated session,     potentially leading to full administrative control if an IdM administrator is targeted. (CVE-2026-18147)

    A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending     oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration     handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage,     slower request handling, and potential service disruption or denial of service. (CVE-2026-73197)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-72279 advisory.

    - Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval() reachable before authorization check     allows environment disclosure and denial of service
    - Resolves: RHEL-245626 CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a     privileged AD trust refresh, allowing unauthorized LDAP writes [rhel-10.2.z]
    - Resolves: RHEL-245473 CVE-2026-76578 ipa: FreeIPA: unauthenticated LDAP client can obtain administrator     credentials via the self-managed-token ACI
    - Resolves: RHEL-240909 CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to     realm-unaware uniqueness enforcement in FreeIPA LDAP datastore [rhel-10.2.z]
    - Resolves: RHEL-240842 CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust     relationships [rhel-10.2.z]
    - Resolves: RHEL-240821 CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py     via Unbounded Request Body Read [rhel-10.2.z]
    - Resolves: RHEL-240800 CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via     Unbounded Request Body Read [rhel-10.2.z]
    - Resolves: RHEL-218853 CVE-2026-18147 ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows     arbitrary code execution via crafted URL

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72279 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)

    * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)

    * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)

    * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)

    * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement     in FreeIPA LDAP datastore (CVE-2026-13097)

    * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)

    * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure     and denial of service (CVE-2026-79678)

    Bug Fix(es) and Enhancement(s):

    * [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL10.2] (JIRA:RHEL-173375)

    * WebUI Hardening [rhel-10.2.z] (JIRA:RHEL-238510)

    * ipa-otptoken-import hardening [rhel-10.2.z] (JIRA:RHEL-238518)

    * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z]     (JIRA:RHEL-238522)

    *  ipa env: support only simple * wildcard [rhel-10.2.z] (JIRA:RHEL-238526)

    * ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z] (JIRA:RHEL-238673)

    * ipa-migrate: require Replication Administrator privilege [rhel-10.2.z] (JIRA:RHEL-238676)

    * ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z]     (JIRA:RHEL-240768)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70564 advisory.

    - RHEL-218866 CVE-2026-18147 ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code     execution via crafted URL [rhel-9.8.z]
    - RHEL-245474 CVE-2026-76578 ipa: FreeIPA: unauthenticated LDAP client can obtain administrator     credentials via the self-managed-token ACI [rhel-9.8.z]
    - RHEL-248206 CVE-2026-79678 ipa: freeipa: idp-add eval() reachable before authorization check allows     environment disclosure and denial of service [rhel-9.8.z]
    - RHEL-245627 CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD     trust refresh, allowing unauthorized LDAP writes [rhel-9.8.z]
    - RHEL-240898 CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-     unaware uniqueness enforcement in FreeIPA LDAP datastore [rhel-9.8.z]
    - RHEL-240830 CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust     relationships [rhel-9.8.z]
    - RHEL-240815 CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via     Unbounded Request Body Read [rhel-9.8.z]
    - RHEL-240804 CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request     Body Read [rhel-9.8.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70564 advisory.

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)

    * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)

    * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)

    * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)

    * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement     in FreeIPA LDAP datastore (CVE-2026-13097)

    * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)

    * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure     and denial of service (CVE-2026-79678)

    Bug Fix(es) and Enhancement(s):

    * [Cursor Automated] Include latest fixes in python3-ipatests package [Rocky Linux9.8] (JIRA:Rocky     Linux-170987)

    * WebUI Hardening [rhel-9.8.z] (JIRA:Rocky Linux-238511)

    * ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:Rocky Linux-238519)

    * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z] (JIRA:Rocky     Linux-238523)

    * ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:Rocky Linux-238527)

    * ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:Rocky Linux-238674)

    * ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:Rocky Linux-238677)

    * ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z] (JIRA:Rocky     Linux-240767)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70564 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)

    * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)

    * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)

    * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)

    * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement     in FreeIPA LDAP datastore (CVE-2026-13097)

    * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)

    * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure     and denial of service (CVE-2026-79678)

    Bug Fix(es) and Enhancement(s):

    * [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL9.8] (JIRA:RHEL-170987)

    * WebUI Hardening [rhel-9.8.z] (JIRA:RHEL-238511)

    * ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:RHEL-238519)

    * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z]     (JIRA:RHEL-238523)

    * ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:RHEL-238527)

    * ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:RHEL-238674)

    * ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:RHEL-238677)

    * ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z]     (JIRA:RHEL-240767)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting     (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a     specially crafted link and complete a password reset, the attacker could inject and execute arbitrary     JavaScript code. This allows the attacker to perform actions within the victim's authenticated session,     potentially leading to full administrative control if an IdM administrator is targeted. (CVE-2026-18147)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
359519	Rocky Linux 10.2 [CIQ] Security Update: ipa-client / ipa-client-common / ipa-client-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_72279)	Nessus	Rocky Linux Local Security Checks	Local	high
355683	Rocky Linux 9 [CIQ] Security Update: ipa-client / ipa-client-common / ipa-client-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_70564)	Nessus	Rocky Linux Local Security Checks	Local	high
351125	AlmaLinux 10 : ipa (ALSA-2026:72279)	Nessus	Alma Linux Local Security Checks	Local	high
351106	RockyLinux 10 : ipa (RLSA-2026:72279)	Nessus	Rocky Linux Local Security Checks	Local	high
351101	MiracleLinux 9 : ipa-4.13.4-1.el9_8 (AXSA:2026-1928:05)	Nessus	Miracle Linux Local Security Checks	Local	high
351067	Amazon Linux 2 : ipa (ALAS-2026-3950)	Nessus	Amazon Linux Local Security Checks	Local	high
350943	Oracle Linux 10 : ipa (ELSA-2026-72279)	Nessus	Oracle Linux Local Security Checks	Local	high
350897	RHEL 10 : ipa (RHSA-2026:72279)	Nessus	Red Hat Local Security Checks	Local	high
350078	Oracle Linux 9 : ipa (ELSA-2026-70564)	Nessus	Oracle Linux Local Security Checks	Local	high
349902	RockyLinux 9 : ipa (RLSA-2026:70564)	Nessus	Rocky Linux Local Security Checks	Local	high
349627	RHEL 9 : ipa (RHSA-2026:70564)	Nessus	Red Hat Local Security Checks	Local	high
344356	Linux Distros Unpatched Vulnerability : CVE-2026-18147	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-18147

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high