Vulnerability Intelligence Report
Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships
CVE-2026-11861
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.
No Active Exploit Signals
CVSS Base Score
9.6
CRITICAL
Exploitability:3.2
Impact Score:5.8
EPSS Probability:0.35%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-266 ↗Incorrect Privilege Assignment
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:4.13.4-1.el10_2 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 0:4.12.2-15.el10_0.7 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | 0:4.6.8-5.el7_9.25 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8 | 8100020261007071200.143e9e98 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8 | 8100020261007070536.823393f5 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | 8040020261027121250.f153676a < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | 8040020261027121355.5b01ab7e < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | 8040020261027121250.f153676a < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | 8040020261027121355.5b01ab7e < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | 8060020261008134123.c1533a64 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | 8060020261008133528.ada582f1 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | 8060020261008134123.c1533a64 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | 8060020261008133528.ada582f1 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | 8080020261007080925.e581a9e4 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | 8080020261007071832.b0a6ceea < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | 8080020261007080925.e581a9e4 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | 8080020261007071832.b0a6ceea < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 9 | 0:4.13.4-1.el9_8 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | 0:4.10.1-12.el9_2.7 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | 0:4.11.0-15.el9_4.9 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 0:4.12.2-14.el9_6.8 < * (unaffected) |
| Red Hat | Red Hat Enterprise Linux 6 | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.350%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Red Hat, Inc. · Vendor · USA |
| Reserved | 2026-06-10T11:21:33 |
| Published | 2026-08-20T10:39:08 |
| Patch Date | 2026-08-20 |
| Last Updated | 2026-11-02T03:28:20 |
Community Chatter & Buzz