A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Freeipa
  • Freeipa
Redhat
  • Enterprise Linux
  • Enterprise Linux Eus
  • Rhel E4s
  • Rhel Eus
  • Rhel Tus

Configuration 1 [-]

OR cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:a:freeipa:freeipa:4.12.2:*:*:*:*:*:*:*

No data.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:70564 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:72279 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:82935 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:83083 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:83084 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:83085 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:83460 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2026:83461 cve-icon cve-icon
https://access.redhat.com/security/cve/CVE-2026-13097 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2515974 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-13097 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-13097 cve-icon
History

Thu, 15 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Tus
CPEs cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
Vendors & Products Redhat rhel Tus
References

Wed, 14 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.4::appstream
References

Wed, 14 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel E4s
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/a:redhat:rhel_eus:9.6::crb
Vendors & Products Redhat rhel E4s
Redhat rhel Eus
References

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
CPEs cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
References

Mon, 28 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References

Thu, 24 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
References

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

 cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N'}

Mon, 24 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Freeipa
Freeipa freeipa
CPEs cpe:2.3:a:freeipa:freeipa:4.12.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Freeipa
Freeipa freeipa

Fri, 21 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 20 Aug 2026 11:00:00 +0000

Type Values Removed Values Added
Description A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.
Title Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-706
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2026-08-20T10:37:55.464Z

Updated: 2026-10-15T05:07:43.751Z

Reserved: 2026-06-23T19:29:29.484Z

Link: CVE-2026-13097

cve-icon Vulnrichment

Updated: 2026-08-21T18:12:05.557Z

cve-icon NVD

Status : Modified

Published: 2026-08-20T11:16:20.293

Modified: 2026-10-15T06:17:01.940

Link: CVE-2026-13097

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-20T10:19:07Z

Links: CVE-2026-13097 - Bugzilla