A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

alma_linux ALSA-2026:72279: ALSA-2026:72279: ipa security, bug fix, and enhancement update (Critical)

rocky_linux RLSA-2026:72279: RLSA-2026:72279: ipa security, bug fix, and enhancement update (Critical)

alma_linux ALSA-2026:70564: ALSA-2026:70564: ipa security, bug fix, and enhancement update (Critical)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1928:05 advisory.

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)
      * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)
      * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)
      * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)
      * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)
      * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness     enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
      * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)
      * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment     disclosure and denial of service (CVE-2026-79678)     Bug Fix(es) and Enhancement(s):
      * [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL9.8] (JIRA:RHEL-170987)
      * WebUI Hardening [rhel-9.8.z] (JIRA:RHEL-238511)
      * ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:RHEL-238519)
      * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z]     (JIRA:RHEL-238523)
      * ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:RHEL-238527)
      * ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:RHEL-238674)
      * ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:RHEL-238677)
      * ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z]     (JIRA:RHEL-240767)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-72279 advisory.

    - Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval() reachable before authorization check     allows environment disclosure and denial of service
    - Resolves: RHEL-245626 CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a     privileged AD trust refresh, allowing unauthorized LDAP writes [rhel-10.2.z]
    - Resolves: RHEL-245473 CVE-2026-76578 ipa: FreeIPA: unauthenticated LDAP client can obtain administrator     credentials via the self-managed-token ACI
    - Resolves: RHEL-240909 CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to     realm-unaware uniqueness enforcement in FreeIPA LDAP datastore [rhel-10.2.z]
    - Resolves: RHEL-240842 CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust     relationships [rhel-10.2.z]
    - Resolves: RHEL-240821 CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py     via Unbounded Request Body Read [rhel-10.2.z]
    - Resolves: RHEL-240800 CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via     Unbounded Request Body Read [rhel-10.2.z]
    - Resolves: RHEL-218853 CVE-2026-18147 ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows     arbitrary code execution via crafted URL

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72279 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)

    * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)

    * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)

    * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)

    * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement     in FreeIPA LDAP datastore (CVE-2026-13097)

    * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)

    * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure     and denial of service (CVE-2026-79678)

    Bug Fix(es) and Enhancement(s):

    * [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL10.2] (JIRA:RHEL-173375)

    * WebUI Hardening [rhel-10.2.z] (JIRA:RHEL-238510)

    * ipa-otptoken-import hardening [rhel-10.2.z] (JIRA:RHEL-238518)

    * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z]     (JIRA:RHEL-238522)

    *  ipa env: support only simple * wildcard [rhel-10.2.z] (JIRA:RHEL-238526)

    * ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z] (JIRA:RHEL-238673)

    * ipa-migrate: require Replication Administrator privilege [rhel-10.2.z] (JIRA:RHEL-238676)

    * ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z]     (JIRA:RHEL-240768)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70564 advisory.

    - RHEL-218866 CVE-2026-18147 ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code     execution via crafted URL [rhel-9.8.z]
    - RHEL-245474 CVE-2026-76578 ipa: FreeIPA: unauthenticated LDAP client can obtain administrator     credentials via the self-managed-token ACI [rhel-9.8.z]
    - RHEL-248206 CVE-2026-79678 ipa: freeipa: idp-add eval() reachable before authorization check allows     environment disclosure and denial of service [rhel-9.8.z]
    - RHEL-245627 CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD     trust refresh, allowing unauthorized LDAP writes [rhel-9.8.z]
    - RHEL-240898 CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-     unaware uniqueness enforcement in FreeIPA LDAP datastore [rhel-9.8.z]
    - RHEL-240830 CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust     relationships [rhel-9.8.z]
    - RHEL-240815 CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via     Unbounded Request Body Read [rhel-9.8.z]
    - RHEL-240804 CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request     Body Read [rhel-9.8.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70564 advisory.

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)

    * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)

    * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)

    * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)

    * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement     in FreeIPA LDAP datastore (CVE-2026-13097)

    * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)

    * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure     and denial of service (CVE-2026-79678)

    Bug Fix(es) and Enhancement(s):

    * [Cursor Automated] Include latest fixes in python3-ipatests package [Rocky Linux9.8] (JIRA:Rocky     Linux-170987)

    * WebUI Hardening [rhel-9.8.z] (JIRA:Rocky Linux-238511)

    * ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:Rocky Linux-238519)

    * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z] (JIRA:Rocky     Linux-238523)

    * ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:Rocky Linux-238527)

    * ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:Rocky Linux-238674)

    * ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:Rocky Linux-238677)

    * ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z] (JIRA:Rocky     Linux-240767)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70564 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)

    * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)

    * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)

    * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)

    * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement     in FreeIPA LDAP datastore (CVE-2026-13097)

    * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)

    * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure     and denial of service (CVE-2026-79678)

    Bug Fix(es) and Enhancement(s):

    * [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL9.8] (JIRA:RHEL-170987)

    * WebUI Hardening [rhel-9.8.z] (JIRA:RHEL-238511)

    * ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:RHEL-238519)

    * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z]     (JIRA:RHEL-238523)

    * ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:RHEL-238527)

    * ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:RHEL-238674)

    * ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:RHEL-238677)

    * ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z]     (JIRA:RHEL-240767)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9736fef3-ada6-11f1-a655-3497f65b111b advisory.

    The FreeIPA project reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3916 advisory.

    A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not     restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can     exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked     separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the     administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA     administrator-group membership and perform administrative operations against the directory and, on SID-     enabled deployments, other IdM services. (CVE-2026-76578)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not     restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can     exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked     separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the     administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA     administrator-group membership and perform administrative operations against the directory and, on SID-     enabled deployments, other IdM services. (CVE-2026-76578)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
351101	MiracleLinux 9 : ipa-4.13.4-1.el9_8 (AXSA:2026-1928:05)	Nessus	Miracle Linux Local Security Checks	Local	high
350943	Oracle Linux 10 : ipa (ELSA-2026-72279)	Nessus	Oracle Linux Local Security Checks	Local	high
350897	RHEL 10 : ipa (RHSA-2026:72279)	Nessus	Red Hat Local Security Checks	Local	high
350078	Oracle Linux 9 : ipa (ELSA-2026-70564)	Nessus	Oracle Linux Local Security Checks	Local	high
349902	RockyLinux 9 : ipa (RLSA-2026:70564)	Nessus	Rocky Linux Local Security Checks	Local	high
349627	RHEL 9 : ipa (RHSA-2026:70564)	Nessus	Red Hat Local Security Checks	Local	high
344816	FreeBSD : FreeIPA -- multiple vulnerabilities (9736fef3-ada6-11f1-a655-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	high
344422	Amazon Linux 2 : ipa (ALAS-2026-3916)	Nessus	Amazon Linux Local Security Checks	Local	critical
343451	Linux Distros Unpatched Vulnerability : CVE-2026-76578	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-76578

critical

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

critical

critical