Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Rocky IPA allows denial‑of‑service and privilege escalation
published 20 days ago
Summary
The FreeIPA component in Rocky Linux can be forced to crash or become unavailable by sending specially crafted requests, and it also contains flaws that could let an attacker increase their access rights or retrieve admin credentials. These issues affect the IPA identity management service used for login and access control. Apply the latest Rocky Linux update that includes the security patches to protect your systems.
What to do
- Update rocky ipa to version 0:4.13.4-1.el10_2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:10 | rocky | ipa |
< 0:4.13.4-1.el10_2 Fix: upgrade to 0:4.13.4-1.el10_2
|
Original advisory text
Critical: ipa security, bug fix, and enhancement update
Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.
Security Fix(es):
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198)
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197)
* FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)
* freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)
* freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)
* ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
* ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)
* freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)
Bug Fix(es) and Enhancement(s):
* [Cursor Automated] Include latest fixes in python3-ipatests package [Rocky Linux10.2] (JIRA:Rocky Linux-173375)
* WebUI Hardening [rhel-10.2.z] (JIRA:Rocky Linux-238510)
* ipa-otptoken-import hardening [rhel-10.2.z] (JIRA:Rocky Linux-238518)
* host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z] (JIRA:Rocky Linux-238522)
* ipa env: support only simple * wildcard [rhel-10.2.z] (JIRA:Rocky Linux-238526)
* ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z] (JIRA:Rocky Linux-238673)
* ipa-migrate: require Replication Administrator privilege [rhel-10.2.z] (JIRA:Rocky Linux-238676)
* ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z] (JIRA:Rocky Linux-240768)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198)
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197)
* FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)
* freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)
* freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)
* ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
* ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)
* freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)
Bug Fix(es) and Enhancement(s):
* [Cursor Automated] Include latest fixes in python3-ipatests package [Rocky Linux10.2] (JIRA:Rocky Linux-173375)
* WebUI Hardening [rhel-10.2.z] (JIRA:Rocky Linux-238510)
* ipa-otptoken-import hardening [rhel-10.2.z] (JIRA:Rocky Linux-238518)
* host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z] (JIRA:Rocky Linux-238522)
* ipa env: support only simple * wildcard [rhel-10.2.z] (JIRA:Rocky Linux-238526)
* ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z] (JIRA:Rocky Linux-238673)
* ipa-migrate: require Replication Administrator privilege [rhel-10.2.z] (JIRA:Rocky Linux-238676)
* ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z] (JIRA:Rocky Linux-240768)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:72279 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2472960 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2474697 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2487472 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2508181 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2514019 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2515974 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2519522 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2523356 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:72279 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published29 Sep 2026
Updated29 Sep 2026
First seen29 Sep 2026
Sources
RLSA-2026:72279 · OSV
Track software like this
Free during beta