CVE-2026-76578Patch

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-306

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
19 mentions across 5 observed days
Momentum state: declining

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 11 signals
Technical details provided in 15 signals
Disclosure: 6 classified signals
General: 1 classified signal
Peaked 4d ago at 8 mentions (2026-09-07); latest day: 1
19 total mentions across 5 days

Deep dive

Activity timeline19 mentions / 5d

Signal classification5 categories

Patch

1052.6%

Disclosure

631.6%

General

15.3%

Disclosed

15.3%

Disclousure

15.3%

Referenced assets11 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-07	8	Disclosure2General1Patch5
2026-09-08	7	Disclosed1Disclosure2Disclousure1Patch3
2026-09-09	2	Disclosure1Patch1
2026-09-10	1	Disclosure1
2026-09-25	1	Patch1

Full discourse19 posts

HOL@HashgraphOnline46d
Patch
If someone can reach your FreeIPA LDAP ports with no login, they can forge an admin account and run your identity server. Red Hat scored it 9.8 and reproduced it on a default install. No fixed RPM yet. Firewall 389/636 and turn off anonymous binds now. https://hol.org/blog/cve-2026-76578-freeipa-unauth-ldap-admin-aci https://t.co/yy9hpzGgN3
Post summary
The post highlights a high‑severity unauthenticated LDAP administrative escalation flaw in FreeIPA, with proof‑of‑concept details available via a linked blog, but no vendor patch yet—users are advised to disable anonymous binds on ports 389/636 as a workaround.
121401.2K
19.1K followersView on X
kokumօtօ@__kokumoto46d
Patch
ID管理製品FreeIPAに重大(Critical)な脆弱性。CVE-2026-76578はCVSSスコア9.8で、無認証で管理者権限が取得可能。LDAPサービスにおけるセルフマネージドOTPトークンでの認証欠如。バージョン4.13.4で修正。 https://securityonline.info/freeipa-cve-2026-76578-vulnerability/
Post summary
CVE-2026-76578 is a critical authentication bypass in FreeIPA’s LDAP service, allowing unauthenticated admin access (CVSS 9.8); the issue is fixed in version 4.13.4.
00022800
7.8K followersView on X
VulDB 🛡@vuldb46d
General
There is a new vulnerability with elevated criticality in Red Hat FreeIPA (CVE-2026-76578) https://vuldb.com/vuln/399546
Post summary
The post announces a newly identified critical vulnerability in Red Hat FreeIPA (CVE-2026-76578) but offers no further details on its nature, exploitation, or mitigation.
10010160
2.3K followersView on X
Kantorcodes | ℏol/acc@Kantorcodes46d
Patch
Anyone who can hit your FreeIPA LDAP with no login can mint an admin. We broke down CVE-2026-76578 and what to do before the RPM lands.
Post summary
The post warns that an unauthenticated attacker can gain admin rights in FreeIPA due to CVE-2026-76578 and advises users to take steps before the updated RPM is released.
10010414
11.0K followersView on X
0x870x4k3r@pepetheshneine28d
Patch
4/6 FreeIPA — CVE-2026-76578 Unauthenticated LDAP access can end with an attacker in the FreeIPA administrators group. CVSS 9.8. No creds. No user interaction. If 389/636 reaches untrusted networks, patch now. Restrict it until then. https://access.redhat.com/security/cve/CVE-2026-76578
Post summary
The text announces a critical CVE in FreeIPA (CVE-2026-76578) with a CVSS of 9.8, where unauthenticated LDAP access can lead to administrative compromise, and strongly recommends patching or restricting network access immediately.
1000040
29 followersView on X
Divinmentis@Divinmentis45d
Disclosure
Red Hat tracks the FreeIPA issue as CVE-2026-76578, rated 9.8, and the 389 Directory Server flaw as CVE-2026-76560, rated 7.5. Red Hat says it reproduced the chain twice on a default installation. https://t.co/vCqDUFuBcs
Post summary
Red Hat reports two high‑severity vulnerabilities in its FreeIPA and 389 Directory Server products, providing CVSS scores and confirming that the exploit chain can be reproduced on a default installation.
1000034
58 followersView on X
The Daily Tech Feed@dailytechonx45d
Patch
Big security alert: Anonymous clients can now craft their way into admin accounts via FreeIPA & 389-ds flaws. If you run FreeIPA, version 4.13.4 has the fixes. Keywords: FreeIPA, 389-ds, CVE-2026-76578, CVE-2026-76560, identity management, privilege escalation. #SecurityNews #FreeIPA #389ds #PrivilegeEscalation #CVE2026 #Linux https://thedailytechfeed.com/critical-freeipa-chain-flaw-lets-anonymous-users-become-admins/
Post summary
A new privilege‑escalation flaw in FreeIPA & 389‑ds (CVE‑2026‑76578, CVE‑2026‑76560) allows anonymous users to become admins, but the issue is fixed in FreeIPA 4.13.4.
0001056
718 followersView on X
Cybersecurity News DE@cybsecuritynews43d
Disclosure
#schwachstellen FreeIPA CVE-2026-76578: Kritische Lücke erlaubt Admin-Zugriff ohne Authentifizierung #cve202676578 #freeipa #kerberos #ldap #redhatidentitymanagement https://cybersecurity-news.de/freeipa-cve-2026-76578-kritische-luecke-admin-zugriff-ohne-authentifizierung
Post summary
A new critical vulnerability (CVE‑2026‑76578) in FreeIPA that permits unauthenticated administrative access has been announced.
0000038
12 followersView on X
DFIR Lab@DFIR_Lab44d
Patch
🚨 CRITICAL: CVE-2026-76578 (CVSS 9.8) - FreeIPA unauthenticated RCE flaw allows remote attackers to create admin principals & join administrators group. No authentication required. Patch immediately. #CVE #PatchNow #ThreatIntel https://t.co/J3Rxd2ZWtS
Post summary
The tweet highlights a high‑severity, unauthenticated RCE in FreeIPA and calls for immediate patching, without mention of exploits or active attacks.
0000046
129 followersView on X
0xAppSec@0xAppSec45d
Disclosure
FreeIPA allowed unauthenticated OTP self-enrollment. The rule said who may write. It never said which attributes could ride along. Chained with a directory server flaw, that became administrator group membership. CVE-2026-76578, 9.8. Allowlist the fields, not just the route.
Post summary
CVE-2026-76578 is a high‑severity flaw that permits unauthenticated OTP self‑enrollment, which, when combined with a directory server exploit, can grant administrator group membership.
0000053
34 followersView on X
Venkata Satish Guttula 🛰️@snakeyesV145d
Patch
News: FreeIPA CVE-2026-76578 (CVSS 9.8) lets an unauthenticated LDAP client mint a Kerberos admin principal via self-managed OTP ACI. Hits FreeIPA/IdM with LDAP exposed. Patch 4.13.4; lock 389/636; drop anonymous binds. https://access.redhat.com/security/cve/cve-2026-76578
Post summary
The article reports the high‑severity CVE‑2026‑76578 affecting FreeIPA/IdM, offers mitigation steps and a patch, while not providing evidence of active exploitation or a proof of concept.
00000113
3.0K followersView on X
LinuxGeek 🐧@NewsOfLinux45d
Patch
The fix is the tidy part. That ACI's bind rule matched userdn ldap:///self. Now it has to match ldap:///all as well, and an anonymous bind's empty DN can't. CVE-2026-76578. 4.13.4 also fixes idp-add reaching eval() before the authorization check. https://www.freeipa.org/release-notes/4-13-4.html
Post summary
The note confirms that FreeIPA 4.13.4 includes a patch for CVE-2026-76578, addressing an unauthorized eval() execution, with no evidence of active exploitation or PoC code.
0000038
124 followersView on X
Xavier Rivera@XavierRiveraX45d
Disclosed
Red Hat FreeIPA/IdM flaw chain lets an anonymous client mint a chosen Kerberos identity and join the administrators group. CVE-2026-76578 scores CVSS 9.8 critical (preliminary) and needs a paired 389 Directory Server access-control bug (CVE-2026-76560). Fixed in FreeIPA 4.13.4; Red Hat reproduced it on a default install with no prior login.
Post summary
Red Hat disclosed a critical flaw chain in FreeIPA/IdM that lets an anonymous client create a Kerberos identity and join the administrators group. The issue, rated CVSS 9.8, is fixed in FreeIPA 4.13.4.
0000059
604 followersView on X
NEXSIGHT@NEXSIGHTNEWS45d
Disclousure
FreeIPAに未認証で管理者権限を奪取される脆弱性CVE-2026-76578 — Red Hatが緊急警告、匿名LDAPで“管理者グループ”に侵入可能 https://cyber.nexsight.co/articles/2026/09/08/freeipa-cve-2026-76578-anonymous-admin-takeover-2026-09-08/
Post summary
The article announces an unauthenticated administrator‑takeover vulnerability in FreeIPA (CVE‑2026‑76578) that can be abused via anonymous LDAP, prompting an urgent advisory from Red Hat.
0000054
65 followersView on X
Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs45d
Disclosure
CVE-2026-76578 FreeIPA / Red Hat ID Management Unauthenticated LDAP clients could grant administrator group membership, enabling identity infrastructure takeover Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-09-07/TIER_2_CVE-2026-76578.md #CyberSecurity #IdentitySecurity #VulnerabilityManagement
Post summary
The tweet announces CVE‑2026‑76578, a vulnerability in FreeIPA/Red Hat ID Management that allows unauthenticated LDAP clients to grant administrator privileges and potentially take over the identity infrastructure. It links to a detailed analysis but lacks PoC, exploits, patches, or claims of active exploitation.
0000053
61 followersView on X
Severity Daily@severitydaily46d
Disclosure
FreeIPA's self-managed token ACI lets an unauthenticated LDAP client into the administrators group. Red Hat rates it 9.8, says it confirmed the technique against a default install, and lists no fixed package for any product. https://severitydaily.com/freeipa-cve-2026-76578-self-managed-token-aci-unauthenticated-admin-no-fix/
Post summary
The post discloses a FreeIPA CVE that allows unauthenticated LDAP clients to gain administrator rights, confirmed by Red Hub, with no patch available yet.
0000025
23 followersView on X
Upwind Security MDR@UpwindMDR46d
Disclosure
🚨Critical - FreeIPA Unauth LDAP ACI Abuse to Admin Group (CVE-2026-76578) FreeIPA’s self-managed OTP token ACI can be evaluated without auth and without restricting attributes on token entries. An unauthenticated LDAP client can chain this with a related 389 Directory Server ACI-evaluation flaw to create an attacker-controlled Kerberos principal and add it to the administrators group, gaining full FreeIPA admin privileges. 👉Affected: FreeIPA (ipa, idm:client/ipa)
Post summary
The text discloses a critical vulnerability in FreeIPA that permits unauthenticated LDAP clients to abuse ACI permissions, create an attacker‑controlled Kerberos principal, and gain full admin privileges, but no patch or exploit code is referenced.
0000067
303 followersView on X
Daily CyberSecurity@Daily_CyberSec46d
Patch
Patch the critical FreeIPA CVE-2026-76578 immediately. This FreeIPA vulnerability allows complete, unauthenticated administrative access to your servers. #FreeIPA #CVE202676578 #Vulnerability #CyberSecurity #CVE202613097 https://securityonline.info/freeipa-cve-2026-76578-vulnerability/ https://t.co/KDnym37I20
Post summary
The tweet urges immediate patching of FreeIPA CVE-2026-76578, highlighting its ability to grant unauthenticated admin access, but it does not provide PoC or exploitation details.
00000457
12.9K followersView on X
HOL@HashgraphOnline46d
Patch
CVE-2026-76578. Upstream FreeIPA already landed the OTP ACI harden. Until your vendor package ships, treat open LDAP as an emergency.
Post summary
CVE‑2026‑76578 is being addressed by upstream FreeIPA, but vendors lack updated packages yet; users should treat open LDAP as an emergency until a vendor patch is available.
00000150
19.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-76578

kokumօtօ[verified]@__kokumotoPatch

CVE-2026-76578 is a critical authentication bypass in FreeIPA’s LDAP service, allowing unauthenticated admin access (CVSS 9.8); the issue is fixed in version 4.13.4.

Kantorcodes | ℏol/acc[verified]@KantorcodesPatch

The post warns that an unauthenticated attacker can gain admin rights in FreeIPA due to CVE-2026-76578 and advises users to take steps before the updated RPM is released.

Divinmentis[verified]@DivinmentisDisclosure

Red Hat reports two high‑severity vulnerabilities in its FreeIPA and 389 Directory Server products, providing CVSS scores and confirming that the exploit chain can be reproduced on a default installation.

The Daily Tech Feed[verified]@dailytechonxPatch

A new privilege‑escalation flaw in FreeIPA & 389‑ds (CVE‑2026‑76578, CVE‑2026‑76560) allows anonymous users to become admins, but the issue is fixed in FreeIPA 4.13.4.

DFIR Lab[verified]@DFIR_LabPatch

The tweet highlights a high‑severity, unauthenticated RCE in FreeIPA and calls for immediate patching, without mention of exploits or active attacks.

0xAppSec[verified]@0xAppSecDisclosure

CVE-2026-76578 is a high‑severity flaw that permits unauthenticated OTP self‑enrollment, which, when combined with a directory server exploit, can grant administrator group membership.

Venkata Satish Guttula 🛰️[verified]@snakeyesV1Patch

The article reports the high‑severity CVE‑2026‑76578 affecting FreeIPA/IdM, offers mitigation steps and a patch, while not providing evidence of active exploitation or a proof of concept.

Xavier Rivera[verified]@XavierRiveraXDisclosed

Red Hat disclosed a critical flaw chain in FreeIPA/IdM that lets an anonymous client create a Kerberos identity and join the administrators group. The issue, rated CVSS 9.8, is fixed in FreeIPA 4.13.4.