Posted on

FreeIPA / Red Hat IdM CVE-2026-76578 and CVE-2026-76560 – Unauthenticated Administrator Takeover

Threat Overview

Red Hat disclosed a critical FreeIPA/Identity Management flaw, CVE-2026-76578, that can be chained with CVE-2026-76560 in the underlying 389 Directory Server to give an unauthenticated LDAP client genuine FreeIPA administrators-group membership. The flaw is not a conventional OS-level remote code execution bug; it is a directory and identity control-plane takeover. Red Hat states that the original technique was independently reproduced against a default, unmodified FreeIPA installation with no credentials, no user interaction, and only network reachability to LDAP.

The chain abuses FreeIPA’s self-managed OTP token access-control rule and the directory server’s handling of anonymous binds. An anonymous client can create attacker-controlled directory data that results in an attacker-chosen Kerberos principal being placed in the administrators group. On SID-enabled deployments, the resulting privilege can affect additional IdM services. Upstream FreeIPA 4.13.4 hardens the affected access-control behavior, while Red Hat’s product page states that some supported product packages may still require vendor-specific errata or mitigation. Red Hat recommends restricting LDAP ports 389/636 to trusted hosts and disabling anonymous binds where operationally safe until an appropriate fixed package is installed.

References

Impacted Systems

Vendor/product: FreeIPA servers and Red Hat Identity Management servers/replicas using FreeIPA with 389 Directory Server. Primary vulnerable service: LDAP/LDAPS on TCP 389/636. Attack prerequisite: network reachability to the LDAP service; no existing FreeIPA credentials or user interaction are required for the demonstrated chain. Upstream FreeIPA fix: 4.13.4. Red Hat package status may differ by RHEL/IdM release; use Red Hat errata for the deployed supported version rather than assuming the upstream version number directly maps to a fixed RHEL RPM. FreeIPA client-only systems using SSSD are not independently exploitable through this server-side ACI flaw, but compromise of their IdM control plane can affect authentication and authorization across enrolled systems.

Why this matters

FreeIPA/IdM can centrally control Linux identities, Kerberos authentication, sudo policy, host enrollment, certificates, DNS, and trust relationships. Unauthenticated administrators-group membership is therefore a high-impact identity compromise even without code execution on the IdM server itself.

Criticality: Critical

Exploitation Status

Red Hat has independently reproduced the exploit chain against a default FreeIPA installation. The sources reviewed do not establish confirmed malicious exploitation in the wild as of September 8, 2026. Treat this as demonstrated and immediately exploitable where vulnerable LDAP is reachable from an untrusted network, not as a confirmed active campaign.

What this hunt looks for

Available Microsoft Sentinel telemetry can be reviewed for untrusted network connections to LDAP/LDAPS, anonymous LDAP binds, anonymous or unusual add/modify operations under OTP or identity-related directory branches, unexpected Kerberos principals or administrators-group changes, and follow-on identity activity where FreeIPA/389 Directory Server access logs, firewall telemetry, Linux Syslog, or other relevant sources are ingested.

Required logs

  • CommonSecurityLog from firewalls or network devices for LDAP/LDAPS exposure hunting
  • Syslog containing FreeIPA / 389 Directory Server access, audit, authentication, and administrative events

First Pass – Untrusted Connections to FreeIPA LDAP/LDAPS

let FreeIPAIPs = dynamic(["REPLACE_WITH_FREEIPA_SERVER_IP"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationIP in (FreeIPAIPs)
| where DestinationPort in (389,636)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP, DestinationPort
| order by Connections desc

New LDAP Source Addresses Compared With Baseline

let FreeIPAIPs = dynamic(["REPLACE_WITH_FREEIPA_SERVER_IP"]);
let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(2d))
| where DestinationIP in (FreeIPAIPs)
| where DestinationPort in (389,636)
| summarize by SourceIP;
CommonSecurityLog
| where TimeGenerated > ago(2d)
| where DestinationIP in (FreeIPAIPs)
| where DestinationPort in (389,636)
| where SourceIP !in (Baseline)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count() by SourceIP, DestinationIP, DestinationPort
| order by FirstSeen desc

389 Directory Server Anonymous Bind Activity

let FreeIPAHosts = dynamic(["REPLACE_WITH_FREEIPA_SERVER_HOSTNAME"]);
Syslog
| where TimeGenerated > ago(14d)
| where Computer in~ (FreeIPAHosts)
| where SyslogMessage has_any ("BIND dn=\"\"","SASL ANONYMOUS","anonymous bind","Anonymous")
| project TimeGenerated, Computer, ProcessName, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

Anonymous or Suspicious LDAP Add Operations Under OTP

let FreeIPAHosts = dynamic(["REPLACE_WITH_FREEIPA_SERVER_HOSTNAME"]);
Syslog
| where TimeGenerated > ago(14d)
| where Computer in~ (FreeIPAHosts)
| where SyslogMessage has "ADD"
| where SyslogMessage has_any ("cn=otp","ipatoken","ipaTokenOwner","managedBy")
| project TimeGenerated, Computer, ProcessName, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

Kerberos Principal Creation or Modification in Directory Logs

let FreeIPAHosts = dynamic(["REPLACE_WITH_FREEIPA_SERVER_HOSTNAME"]);
Syslog
| where TimeGenerated > ago(14d)
| where Computer in~ (FreeIPAHosts)
| where SyslogMessage has_any ("krbPrincipalName","krbPrincipalKey","principal")
| where SyslogMessage has_any ("ADD","MOD","added","modified","created")
| project TimeGenerated, Computer, ProcessName, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

Administrators Group Membership Changes

let FreeIPAHosts = dynamic(["REPLACE_WITH_FREEIPA_SERVER_HOSTNAME"]);
Syslog
| where TimeGenerated > ago(30d)
| where Computer in~ (FreeIPAHosts)
| where SyslogMessage has_any ("cn=admins","administrators","member","memberOf")
| where SyslogMessage has_any ("ADD","MOD","added","modified","created")
| project TimeGenerated, Computer, ProcessName, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

Rare FreeIPA Administrative Activity

let FreeIPAHosts = dynamic(["REPLACE_WITH_FREEIPA_SERVER_HOSTNAME"]);
Syslog
| where TimeGenerated > ago(14d)
| where Computer in~ (FreeIPAHosts)
| where SyslogMessage has_any ("user-add","user-del","group-add-member","host-add","service-add","privilege","permission","sudo")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=count(), Messages=make_set(SyslogMessage,50) by Computer, ProcessName
| order by LastSeen desc

FreeIPA Host Authentication and Privileged Session Fallback

let FreeIPAHosts = dynamic(["REPLACE_WITH_FREEIPA_SERVER_HOSTNAME"]);
Syslog
| where TimeGenerated > ago(14d)
| where Computer in~ (FreeIPAHosts)
| where SyslogMessage has_any ("sshd","sudo","su:","authentication","session opened")
| project TimeGenerated, Computer, ProcessName, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

Detection Notes

The best evidence is 389 Directory Server access/audit logging that preserves LDAP bind and modification operations. Generic Linux Syslog without directory access logs may not expose the anonymous ADD/MOD sequence. CommonSecurityLog can identify unexpected network reachability to TCP 389/636 but cannot prove exploitation by itself. The upstream FreeIPA 4.13.4 fix does not mean every Red Hat IdM package on every RHEL release has the same version number; use vendor errata for the deployed platform. There is no confirmed malicious campaign in the sources reviewed, so do not treat ordinary anonymous LDAP reads as compromise without corroborating write or privilege-change activity.