CVE-2026-11861CWE-266

CVE-2026-11861

Critical · published August 20, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-08-20T15:16Z
Affected products (5)
ProductVersionsFixed in
freeipa/freeipa< 4.13.34.13.3
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
References (10)
https://access.redhat.com/errata/RHSA-2026:70564 · [email protected]https://access.redhat.com/errata/RHSA-2026:72279 · [email protected]https://access.redhat.com/errata/RHSA-2026:82935 · [email protected]https://access.redhat.com/errata/RHSA-2026:83083 · [email protected]https://access.redhat.com/errata/RHSA-2026:83084 · [email protected]https://access.redhat.com/errata/RHSA-2026:83085 · [email protected]https://access.redhat.com/errata/RHSA-2026:83460 · [email protected]https://access.redhat.com/errata/RHSA-2026:83461 · [email protected]https://access.redhat.com/security/cve/CVE-2026-11861 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2487472 · [email protected]
EPSS history
Timeline
  • 20 AUG 10:39Z
    Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships
    cvelistv5