A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

alma_linux ALSA-2026:70564: ALSA-2026:70564: ipa security, bug fix, and enhancement update (Critical)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72279 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)

    * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)

    * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)

    * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)

    * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement     in FreeIPA LDAP datastore (CVE-2026-13097)

    * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)

    * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure     and denial of service (CVE-2026-79678)

    Bug Fix(es) and Enhancement(s):

    * [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL10.2] (JIRA:RHEL-173375)

    * WebUI Hardening [rhel-10.2.z] (JIRA:RHEL-238510)

    * ipa-otptoken-import hardening [rhel-10.2.z] (JIRA:RHEL-238518)

    * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z]     (JIRA:RHEL-238522)

    *  ipa env: support only simple * wildcard [rhel-10.2.z] (JIRA:RHEL-238526)

    * ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z] (JIRA:RHEL-238673)

    * ipa-migrate: require Replication Administrator privilege [rhel-10.2.z] (JIRA:RHEL-238676)

    * ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z]     (JIRA:RHEL-240768)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70564 advisory.

    - RHEL-218866 CVE-2026-18147 ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code     execution via crafted URL [rhel-9.8.z]
    - RHEL-245474 CVE-2026-76578 ipa: FreeIPA: unauthenticated LDAP client can obtain administrator     credentials via the self-managed-token ACI [rhel-9.8.z]
    - RHEL-248206 CVE-2026-79678 ipa: freeipa: idp-add eval() reachable before authorization check allows     environment disclosure and denial of service [rhel-9.8.z]
    - RHEL-245627 CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD     trust refresh, allowing unauthorized LDAP writes [rhel-9.8.z]
    - RHEL-240898 CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-     unaware uniqueness enforcement in FreeIPA LDAP datastore [rhel-9.8.z]
    - RHEL-240830 CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust     relationships [rhel-9.8.z]
    - RHEL-240815 CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in /ipa/migration/migration.py via     Unbounded Request Body Read [rhel-9.8.z]
    - RHEL-240804 CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in /ipa/i18n_messages via Unbounded Request     Body Read [rhel-9.8.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70564 advisory.

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)

    * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)

    * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)

    * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)

    * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement     in FreeIPA LDAP datastore (CVE-2026-13097)

    * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)

    * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure     and denial of service (CVE-2026-79678)

    Bug Fix(es) and Enhancement(s):

    * [Cursor Automated] Include latest fixes in python3-ipatests package [Rocky Linux9.8] (JIRA:Rocky     Linux-170987)

    * WebUI Hardening [rhel-9.8.z] (JIRA:Rocky Linux-238511)

    * ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:Rocky Linux-238519)

    * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z] (JIRA:Rocky     Linux-238523)

    * ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:Rocky Linux-238527)

    * ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:Rocky Linux-238674)

    * ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:Rocky Linux-238677)

    * ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z] (JIRA:Rocky     Linux-240767)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70564 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read     (CVE-2026-73198)

    * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read     (CVE-2026-73197)

    * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships     (CVE-2026-11861)

    * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via     crafted URL (CVE-2026-18147)

    * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh,     allowing unauthorized LDAP writes (CVE-2026-19550)

    * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement     in FreeIPA LDAP datastore (CVE-2026-13097)

    * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-     managed-token ACI (CVE-2026-76578)

    * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure     and denial of service (CVE-2026-79678)

    Bug Fix(es) and Enhancement(s):

    * [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL9.8] (JIRA:RHEL-170987)

    * WebUI Hardening [rhel-9.8.z] (JIRA:RHEL-238511)

    * ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:RHEL-238519)

    * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z]     (JIRA:RHEL-238523)

    * ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:RHEL-238527)

    * ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:RHEL-238674)

    * ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:RHEL-238677)

    * ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z]     (JIRA:RHEL-240767)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9736fef3-ada6-11f1-a655-3497f65b111b advisory.

    The FreeIPA project reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url     input reaches a constrained eval() call before the corresponding LDAP access control check is enforced.
    This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the     environment variables of the affected server process and to cause denial of service via memory exhaustion.
    (CVE-2026-79678)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350897	RHEL 10 : ipa (RHSA-2026:72279)	Nessus	Red Hat Local Security Checks	Local	high
350078	Oracle Linux 9 : ipa (ELSA-2026-70564)	Nessus	Oracle Linux Local Security Checks	Local	high
349902	RockyLinux 9 : ipa (RLSA-2026:70564)	Nessus	Rocky Linux Local Security Checks	Local	high
349627	RHEL 9 : ipa (RHSA-2026:70564)	Nessus	Red Hat Local Security Checks	Local	high
344816	FreeBSD : FreeIPA -- multiple vulnerabilities (9736fef3-ada6-11f1-a655-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	high
343474	Linux Distros Unpatched Vulnerability : CVE-2026-79678	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-79678

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high