Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
Rocky IPA may allow crashes and unauthorized access
published 25 days ago
Summary
The Rocky Linux Identity Management service (IPA) has several flaws that could let attackers crash the system, run unwanted code, or obtain admin credentials without logging in. These issues affect the IPA component on Rocky Linux and could disrupt authentication or expose sensitive data. Apply the latest security updates for Rocky IPA as soon as possible to protect your environment.
What to do
- Update rocky ipa to version 0:4.13.4-1.el9_8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:9 | rocky | ipa |
< 0:4.13.4-1.el9_8 Fix: upgrade to 0:4.13.4-1.el9_8
|
Original advisory text
Critical: ipa security, bug fix, and enhancement update
Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.
Security Fix(es):
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198)
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197)
* FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)
* freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)
* freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)
* ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
* ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)
* freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)
Bug Fix(es) and Enhancement(s):
* [Cursor Automated] Include latest fixes in python3-ipatests package [Rocky Linux9.8] (JIRA:Rocky Linux-170987)
* WebUI Hardening [rhel-9.8.z] (JIRA:Rocky Linux-238511)
* ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:Rocky Linux-238519)
* host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z] (JIRA:Rocky Linux-238523)
* ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:Rocky Linux-238527)
* ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:Rocky Linux-238674)
* ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:Rocky Linux-238677)
* ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z] (JIRA:Rocky Linux-240767)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198)
* ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197)
* FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861)
* freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147)
* freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550)
* ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097)
* ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578)
* freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)
Bug Fix(es) and Enhancement(s):
* [Cursor Automated] Include latest fixes in python3-ipatests package [Rocky Linux9.8] (JIRA:Rocky Linux-170987)
* WebUI Hardening [rhel-9.8.z] (JIRA:Rocky Linux-238511)
* ipa-otptoken-import hardening [rhel-9.8.z] (JIRA:Rocky Linux-238519)
* host-mod: handle the password attribute when set with --setattr userpassword= [rhel-9.8.z] (JIRA:Rocky Linux-238523)
* ipa env: support only simple * wildcard [rhel-9.8.z] (JIRA:Rocky Linux-238527)
* ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] (JIRA:Rocky Linux-238674)
* ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] (JIRA:Rocky Linux-238677)
* ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z] (JIRA:Rocky Linux-240767)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:70564 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2472960 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2474697 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2487472 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2508181 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2514019 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2515974 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2519522 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2523356 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:70564 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published24 Sep 2026
Updated24 Sep 2026
First seen24 Sep 2026
Sources
RLSA-2026:70564 · OSV
Track software like this
Free during beta