Public vulnerability disclosure

CVE-2026-79678

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

publishedCWE-95

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

Investigate in Cyber JSON Markdown

Technical severity8.1 highCVSS 3.1 · CNA: redhat

Published2026-09-07Source updated 2026-11-02

Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

There is no configuration-based mitigation that prevents an authenticated but unprivileged principal from reaching the affected code path; upgrading to a fixed package is required once available. Administrators of container-based deployments should verify that credentials supplied via the PASSWORD environment variable during initial container setup do not persist in the running server process's environment.

Source: CNA: redhat

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
Red Hat Enterprise Linux 10 Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.13.4-1.el10_2; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.12.2-15.el10_0.7; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8 Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8100020261007071200.143e9e98; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8 Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8100020261007070536.823393f5; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8040020261027121250.f153676a; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8040020261027121355.5b01ab7e; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8040020261027121250.f153676a; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8040020261027121355.5b01ab7e; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8060020261008134123.c1533a64; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8060020261008133528.ada582f1; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8060020261008134123.c1533a64; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8060020261008133528.ada582f1; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8080020261007080925.e581a9e4; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8080020261007071832.b0a6ceea; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat `idm:client` https://access.redhat.com/downloads/content/package-browser/	≥ 8080020261007080925.e581a9e4; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat `idm:DL1` https://access.redhat.com/downloads/content/package-browser/	≥ 8080020261007071832.b0a6ceea; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9 Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.13.4-1.el9_8; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.10.1-12.el9_2.7; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.11.0-15.el9_4.9; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 9.6 Extended Update Support Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	≥ 0:4.12.2-14.el9_6.8; < * (unaffected, rpm) Other versions: affected	CNA: redhat
Red Hat Enterprise Linux 6 Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unknown	CNA: redhat
Red Hat Enterprise Linux 7 Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: unaffected	CNA: redhat
Red Hat Enterprise Linux 8 Red Hat `ipa` https://access.redhat.com/downloads/content/package-browser/	Range not reported Other versions: affected	CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 8.1 high	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H`	CNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://access.redhat.com/errata/RHSA-2026:70564CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:72279CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:82935CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83083CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83084CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83085CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83460CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:83461CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:89836CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:93452CNA: redhat · vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-79678CNA: redhat · vdb-entry, x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2523356CNA: redhat · issue-tracking, x_refsource_REDHAT