CVE-Katalog

CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal,

[CVE-Katalog]

Schweregrad: Critical · CVSS 9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Published: Aug 20, 2026, 10:39:08 AM UTC
Updated: Aug 20, 2026, 11:16:19 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.35% · Oct 22, 2026

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	freeipa	sid	`4.13.1-1`	vulnerable
Debian	freeipa	trixie	`4.12.4-1`	vulnerable
Debian	freeipa	bookworm	`4.9.11-1`	vulnerable
Cpe	freeipa	Not reported	`4.13.3`	fixed
Cpe	enterprise_linux	Not reported	Not reported	unknown

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	freeipa	source	sid	`(unfixed)`	unimportant	Not reported	Not reported
Debian	freeipa	source	trixie	`(unfixed)`	unimportant	Not reported	Not reported
Debian	freeipa	source	bookworm	`(unfixed)`	unimportant	Not reported	Not reported
Cpe	freeipa	cpe	Not reported	`4.13.3`	Not reported	NVD-CVE-2026-11861	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[freeipa-client]Betroffen
Quellpaket: [freeipa]
Details (2)
- 4.9.11-1 · amd64 · bookworm
  Betroffen
  nvd · freeipa · debian · bookworm
- 4.9.11-1 · arm64 · bookworm
  Betroffen
  nvd · freeipa · debian · bookworm
[freeipa-client-epn]Betroffen
Quellpaket: [freeipa]
Details (2)
- 4.9.11-1 · amd64 · bookworm
  Betroffen
  nvd · freeipa · debian · bookworm
- 4.9.11-1 · arm64 · bookworm
  Betroffen
  nvd · freeipa · debian · bookworm
[freeipa-client-samba]Betroffen
Quellpaket: [freeipa]
Details (2)
- 4.9.11-1 · amd64 · bookworm
  Betroffen
  nvd · freeipa · debian · bookworm
- 4.9.11-1 · arm64 · bookworm
  Betroffen
  nvd · freeipa · debian · bookworm
[freeipa-common]Betroffen
Quellpaket: [freeipa]
Details (2)
- 4.9.11-1 · all · bookworm
  Betroffen
  nvd · freeipa · debian · bookworm
- 4.9.11-1 · all · bookworm
  Betroffen
  nvd · freeipa · debian · bookworm
[python3-ipaclient]Betroffen
Quellpaket: [freeipa]
Details (2)
- 4.9.11-1 · all · bookworm
  Betroffen
  nvd · freeipa · debian · bookworm
- 4.9.11-1 · all · bookworm
  Betroffen
  nvd · freeipa · debian · bookworm
[python3-ipalib]Betroffen
Quellpaket: [freeipa]
Details (2)
- 4.9.11-1 · all · bookworm
  Betroffen
  nvd · freeipa · debian · bookworm
- 4.9.11-1 · all · bookworm
  Betroffen
  nvd · freeipa · debian · bookworm

Beobachtet: Oct 23, 2026, 9:38:41 PM UTC

Referenzen

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]