Public vulnerability disclosure

CVE-2026-19550

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

publishedCWE-863

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

Investigate in Cyber JSON Markdown

Technical severity8.2 highCVSS 3.1 · CNA: redhat

Published2026-08-11Source updated 2026-11-02

Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

This issue is fixed upstream. Administrators should apply this fix once available for their platform. Until then, the previously suggested compensating control (restricting "System: Read Trust Information" so it is not granted to all authenticated users) remains a valid interim workaround, with the same caveat that doing so may affect SSSD subdomain support, which relies on that permission's default breadth.

Source: CNA: redhat

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
Red Hat Enterprise Linux 10 Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.13.4-1.el10_2; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.12.2-15.el10_0.7; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 7 Extended Lifecycle Support Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.6.8-5.el7_9.25; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8 Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8100020261007071200.143e9e98; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8 Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8100020261007070536.823393f5; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8040020261027121250.f153676a; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8040020261027121355.5b01ab7e; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8040020261027121250.f153676a; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8040020261027121355.5b01ab7e; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8060020261008134123.c1533a64; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8060020261008133528.ada582f1; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8060020261008134123.c1533a64; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8060020261008133528.ada582f1; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8080020261007080925.e581a9e4; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8080020261007071832.b0a6ceea; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8080020261007080925.e581a9e4; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8080020261007071832.b0a6ceea; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9 Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.13.4-1.el9_8; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.10.1-12.el9_2.7; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.11.0-15.el9_4.9; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9.6 Extended Update Support Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.12.2-14.el9_6.8; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 6 Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 8.2 high	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N`	CNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://access.redhat.com/errata/RHSA-2026:70564CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:72279CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:82935CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83083CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83084CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83085CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83460CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83461CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:89836CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:93071CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:93452CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-19550CNA: redhat · vdb-entry, x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2514019CNA: redhat · issue-tracking, x_refsource_REDHAT