Overview
A critical authentication bypass vulnerability has been disclosed in FreeIPA affecting deployments with an Active Directory (AD) trust relationship configured. Tracked as CVE-2026-11861 with a CVSS score of 9.6, the flaw allows Active Directory users to bypass authentication for FreeIPA services — including the web portal, SMB server, and LDAP directory — by impersonating a client name within a Kerberos Ticket Granting Ticket (TGT) request.
This vulnerability is especially concerning for hybrid environments where FreeIPA and Active Directory coexist in a trust relationship, as it effectively undermines the authentication boundary between the two identity systems.
Technical Details
When FreeIPA and Active Directory are configured in a trust relationship, FreeIPA accepts Kerberos tickets from the AD realm for cross-realm authentication. The flaw arises in how FreeIPA processes the client name field within Ticket Granting Ticket (TGT) requests originating from the AD realm.
A malicious Active Directory user can craft a TGT request that impersonates a legitimate FreeIPA user's client name in the Kerberos exchange. Because FreeIPA does not properly validate that the requesting AD identity is authorized to act on behalf of the claimed FreeIPA client name, the server accepts the request and grants access:
- FreeIPA web portal — administrative access
- SMB server — file share access
- LDAP directory — read/write access to directory data
The attack requires the attacker to already have a valid Active Directory account, making this an insider threat or compromised-account scenario. However, given the broad access this can grant within the FreeIPA realm, the impact is severe.
Affected Products
| Product | Configuration | Status |
|---|---|---|
| FreeIPA | AD trust enabled | Vulnerable |
| Red Hat Identity Management | AD trust enabled | Affected |
| Any FreeIPA deployment | No AD trust | Not affected |
Attack Prerequisites
- Attacker holds a valid Active Directory user account in the trusted AD domain
- FreeIPA-AD trust relationship is configured
- Network access to FreeIPA services (web portal, SMB, LDAP, KDC)
Impact
- Complete authentication bypass for any FreeIPA service accepting Kerberos authentication
- Impersonation of any FreeIPA user, including administrators
- Unauthorized LDAP access enabling directory enumeration and modification
- SMB share access across the FreeIPA realm
- Potential for full FreeIPA realm compromise from a single compromised AD account
Remediation
- Apply the FreeIPA security patch from your distribution immediately — this is the primary fix.
- Audit cross-realm Kerberos trust policies and restrict which AD accounts are permitted to access FreeIPA services.
- Implement PAC (Privilege Attribute Certificate) validation to verify the authorization data in cross-realm tickets.
- Review FreeIPA-AD trust configuration — if the trust is not operationally required, consider disabling it until patched.
- Monitor Kerberos authentication logs for cross-realm TGT requests from unexpected AD accounts.
- Enable FreeIPA audit logging and alert on access from AD users to sensitive services.
Detection
Look for authentication events in your FreeIPA KDC logs where:
- The client realm is the AD domain (
@ADDOMAIN) but the client name matches a local FreeIPA principal - Cross-realm TGT requests for privileged FreeIPA accounts from AD users without an established delegation chain
References
- NVD Entry — CVE-2026-11861
- FreeIPA Documentation — AD Trust: https://www.freeipa.org/page/Active_Directory_trust_setup
- FreeIPA Security Advisories: https://www.freeipa.org/page/Security