Overview
A critical privilege escalation vulnerability has been disclosed in FreeIPA, the widely-used open-source identity management solution for Linux environments. Tracked as CVE-2026-13097 with a CVSS score of 9.1, the flaw resides in how the 389-ds (389 Directory Server) enforces uniqueness constraints on Kerberos principal name attributes.
The issue allows a user who already holds sufficient LDAP write privileges to craft equivalent but non-identical representations of an existing Kerberos principal name, effectively bypassing the uniqueness constraint and creating duplicate principal entries. This can be leveraged to impersonate other accounts or escalate privileges within the FreeIPA environment.
Technical Details
FreeIPA uses 389-ds as its backend LDAP directory store. Kerberos principal names are stored as LDAP attributes, and 389-ds enforces a uniqueness plugin to prevent duplicate entries. However, Kerberos principal names can have multiple equivalent string representations — for example, case variations or alternative encoding forms — that are treated as identical by the Kerberos protocol but not normalized consistently by the 389-ds uniqueness plugin.
An attacker with LDAP write permissions (such as a delegated administrator or a compromised service account with write access) can:
- Identify an existing privileged Kerberos principal (e.g., an admin account).
- Craft an equivalent principal name that passes the 389-ds uniqueness check.
- Register the duplicate principal in the directory.
- Obtain a Kerberos ticket for the duplicate principal, effectively impersonating the privileged account.
This vulnerability is particularly dangerous in multi-tenant or large enterprise deployments where delegated LDAP write access is common.
Affected Products
| Product | Component | Status |
|---|---|---|
| FreeIPA | Kerberos principal management | Vulnerable |
| 389-ds (389 Directory Server) | Uniqueness constraint plugin | Vulnerable |
| Red Hat Identity Management | Built on FreeIPA | Affected |
Impact
- Privilege escalation to any account whose Kerberos principal can be duplicated
- Account impersonation within the FreeIPA realm
- Lateral movement across services using Kerberos SSO (LDAP, SMB, HTTP)
- Requires existing LDAP write privileges — not exploitable anonymously
Remediation
- Apply patches from the FreeIPA and 389-ds maintainers as soon as they become available via your distribution's package manager.
- Audit LDAP write permissions — restrict write access to the minimum required set of accounts and service principals.
- Enable Kerberos principal name normalization in 389-ds to ensure consistent comparison of equivalent representations.
- Monitor for unusual principal creation events in your directory server audit logs.
- Review delegated admin scopes to ensure no accounts have broader LDAP write access than necessary.
References
- NVD Entry — CVE-2026-13097
- FreeIPA Security Advisories: https://www.freeipa.org/page/Security
- 389 Directory Server Project: https://www.port389.org/