Public vulnerability disclosure

CVE-2026-18147

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

publishedCWE-79

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.

Investigate in Cyber JSON Markdown

Technical severity8.1 highCVSS 3.1 · CNA: redhat

Published2026-09-09Source updated 2026-11-02

Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

Restrict network access to the FreeIPA/IdM Web UI to trusted networks only. This can be achieved by configuring firewall rules to limit access to the IdM server's web interface (typically port 443 for HTTPS) from specific IP addresses or subnets. For example, using `firewalld` on RHEL, you can add a rich rule to allow access only from trusted sources. Ensure that any firewall changes are persistent across reboots and that the firewall service is reloaded or restarted for changes to take effect, which may temporarily disrupt access to the IdM Web UI.

Source: CNA: redhat

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
Red Hat Enterprise Linux 10 Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.13.4-1.el10_2; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.12.2-15.el10_0.7; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 7 Extended Lifecycle Support Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.6.8-5.el7_9.25; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8 Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8100020261007071200.143e9e98; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8 Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8100020261007070536.823393f5; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8040020261027121250.f153676a; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8040020261027121355.5b01ab7e; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8040020261027121250.f153676a; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8040020261027121355.5b01ab7e; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8060020261008134123.c1533a64; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8060020261008133528.ada582f1; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8060020261008134123.c1533a64; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8060020261008133528.ada582f1; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8080020261007080925.e581a9e4; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8080020261007071832.b0a6ceea; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8080020261007080925.e581a9e4; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8080020261007071832.b0a6ceea; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9 Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.13.4-1.el9_8; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.10.1-12.el9_2.7; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.11.0-15.el9_4.9; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9.6 Extended Update Support Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.12.2-14.el9_6.8; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 6 Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unknown	CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 8.1 high	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N`	CNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://access.redhat.com/errata/RHSA-2026:70564CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:72279CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:82935CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83083CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83084CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83085CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83460CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83461CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:89836CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:93071CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:93452CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-18147CNA: redhat · vdb-entry, x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2508181CNA: redhat · issue-tracking, x_refsource_REDHAT