Description

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-07T13:20:36.850Z",
  "pubdate": "2026-09-07T13:20:36.850Z",
  "executiveSummary": "A critical security vulnerability has been identified in FreeIPA involving the self-managed One-Time Password (OTP) token Access Control Instruction (ACI).\nThe flaw allows unauthenticated remote attackers to bypass authorization checks and inject arbitrary attributes into the directory service.\nBy manipulating the LDAP entry creation process, an attacker can define a malicious Kerberos principal and assign it to the FreeIPA administrators group.\nThis vulnerability grants unauthorized administrative access, enabling the attacker to perform privileged operations across the IdM infrastructure, including identity and access management functions.\nThe risk is severe, as it facilitates full domain compromise without requiring prior authentication or valid credentials.\nExploitation relies on the interplay between the flawed OTP ACI and existing vulnerabilities in the underlying directory server's ACI evaluation logic.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure ACI configuration governing self-managed OTP token entries within the FreeIPA directory service. The current ACI fails to enforce authentication requirements and neglects to restrict the specific attributes that can be modified or injected during the entry creation process.\nIn a standard deployment, the directory server is expected to validate permissions for all write and modify operations. However, the flawed OTP ACI allows an unauthenticated LDAP client to initiate requests that the directory server incorrectly authorizes.\nThe exploitation flow proceeds as follows: 1) An unauthenticated attacker crafts an LDAP request targeting the OTP token management interface. 2) The attacker leverages the insufficient ACI constraints to bypass authentication and authorization checks. 3) By exploiting an auxiliary vulnerability in the directory server's ACI evaluation engine, the attacker forces the system to process unauthorized attribute additions. 4) The attacker injects a custom Kerberos principal and explicitly assigns this principal membership within the administrative group associated with the FreeIPA domain.\nBecause the directory server trusts the manipulated ACI evaluation, the attacker-controlled principal is successfully provisioned within the directory, inheriting the full privileges of a FreeIPA administrator. On deployments where Security Identifier (SID) support is active, this privilege escalation extends beyond basic directory operations, potentially impacting cross-platform services integrated with IdM.\nThe vulnerability requires no prior knowledge of existing user accounts or administrative credentials. The lack of strict attribute filtering ensures that the attacker can manipulate the schema-related metadata necessary to promote a standard identity entry to an administrative level. Post-exploitation, the attacker maintains persistent administrative access, allowing for the modification of password policies, deletion of audit logs, unauthorized creation of additional accounts, and full control over the Kerberos key distribution infrastructure."
}