CVE-2026-19550— Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FreeIPA是FreeIPA组织开源的一款身份认证与权限管理产品。 FreeIPA存在授权问题漏洞，该漏洞源于trust-fetch-domains命令受信任对象上的只读权限而非信任管理权限控制，可能导致经过身份验证的非特权IPA用户使用攻击者提供的服务器和凭据触发特权Active Directory信任刷新，导致IPA LDAP目录中受信任域和ID范围身份数据被未授权修改。
Affected Version Matrix 5
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:4.13.4-1.el10_2< * |
unaffected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
unaffected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | 0:4.13.4-1.el9_8< * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19550
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
FreeIPA 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreeIPA是FreeIPA组织开源的一款身份认证与权限管理产品。 FreeIPA存在授权问题漏洞，该漏洞源于trust-fetch-domains命令受信任对象上的只读权限而非信任管理权限控制，可能导致经过身份验证的非特权IPA用户使用攻击者提供的服务器和凭据触发特权Active Directory信任刷新，导致IPA LDAP目录中受信任域和ID范围身份数据被未授权修改。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:4.13.4-1.el10_2 ~ * |
cpe:/o:redhat:enterprise_linux:10.2
|
|
| Red Hat | Red Hat Enterprise Linux 9 | 0:4.13.4-1.el9_8 ~ * |
cpe:/a:redhat:enterprise_linux:9::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
II. Public POCs for CVE-2026-19550
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19550
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-19550 (4)
-
-
-
🔗 RHSA-2026:72279 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
🔗 RHSA-2026:70564 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-08-11 · 29 CVEs total
| CVE-2026-10579 | 9.8 CRITICAL | Picketlink-federation: auth bypass in picketlink saml unsolicited-response |
| CVE-2026-19546 | 8.8 HIGH | Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced |
| CVE-2026-15555 | 8.8 HIGH | Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization |
| CVE-2026-15556 | 8.1 HIGH | Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions |
| CVE-2026-15560 | 8.1 HIGH | Openjdk-orb: unauthed class loading via iiop in eap |
| CVE-2026-72693 | 7.8 HIGH | Kbd: local privilege escalation in openvt via incorrect process owner verification allowin |
| CVE-2026-71217 | 7.5 HIGH | Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote de |
| CVE-2026-15567 | 7.5 HIGH | Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop lis |
| CVE-2026-15565 | 7.5 HIGH | Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serveren |
| CVE-2026-15562 | 7.5 HIGH | Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authenticat |
| CVE-2026-15561 | 7.5 HIGH | Undertow-core: oom via missing limits in chunked trailer in eap's undertow |
| CVE-2026-71467 | 7.5 HIGH | Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: w |
| CVE-2026-15554 | 7.4 HIGH | Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery |
| CVE-2026-50237 | 7.4 HIGH | Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin- |
| CVE-2026-15563 | 7.4 HIGH | Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or do |
| CVE-2026-50236 | 7.4 HIGH | Openshift/console: authenticated ssrf with full response reflection and path neutralizatio |
| CVE-2026-71474 | 7.1 HIGH | Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-20 |
| CVE-2026-72694 | 7.1 HIGH | Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file p |
| CVE-2026-71475 | 6.8 MEDIUM | Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into |
| CVE-2026-19391 | 6.5 MEDIUM | Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-108093
Gimp: gimp: denial of service via null pointer dereference i -
CVE-2026-108063
Libhangul: null pointer dereference in hanja_new() when look -
CVE-2026-107655
Cups: null pointer dereference via embedded job ticket comme -
CVE-2026-107565
Luksmeta: incomplete gap-boundary and overlap checks in luks -
CVE-2026-107466
Flatpak-builder: local file exfiltration via `file
Same vendor: Red Hat
-
CVE-2026-108119
Busybox: busybox: tar extraction-root escape via deferred sy -
CVE-2026-108093
Gimp: gimp: denial of service via null pointer dereference i -
CVE-2026-108063
Libhangul: null pointer dereference in hanja_new() when look -
CVE-2026-107935
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary -
CVE-2026-107655
Cups: null pointer dereference via embedded job ticket comme
Same weakness: CWE-863
-
CVE-2026-6723
Appointment Booking Calendar <= 1.6.11.11 - Incorrect Author -
CVE-2026-107841
pacioli: A submit consent marker licensed cancellation of ca -
CVE-2026-78341
Dell SCG 5.34.00.16前存在授权错误漏洞 -
CVE-2026-101028
Ash.count, Ash.exists and Ash.aggregate skip related resourc -
CVE-2026-107728
Strawberry GraphQL: Synchronous permission checks can treat
V. Comments for CVE-2026-19550
No comments yet