CVE-2026-11861 — FreeIPA AD-Trust Authentication Bypass

Executive Summary

CVE-2026-11861 is a critical authentication bypass vulnerability (CVSS 9.6) in FreeIPA's cross-forest trust mechanism with Microsoft Active Directory. The flaw allows an authenticated Active Directory user to impersonate a Kerberos client name in the Ticket Granting Service (TGS) exchange because FreeIPA services fail to verify Privilege Attribute Certificate (PAC) certificates. This permits privilege escalation from a low-privileged AD account to effectively administrator-level access across FreeIPA-managed services, including the web portal, SMB server, and LDAP directory. The vulnerability affects all FreeIPA deployments with AD trust relationships configured; no patch is currently available, and the attack is remotely exploitable, requiring only valid AD credentials.

Technical Analysis

The root cause of CVE-2026-11861 lies in FreeIPA's Kerberos implementation as it pertains to cross-forest trust with Active Directory.

Vulnerability Mechanism: In a properly configured AD-IPA trust, Kerberos service tickets are issued by the AD domain controller (DC) acting as a KDC for the trusted domain. For service tickets to be honored by the resource (FreeIPA), the receiving service must validate the PAC embedded in the ticket. The PAC contains authorization data — including group memberships, user SIDs, and a signature — that the KDC (AD DC) asserts is authentic. By verifying the PAC signature against the trust key, the FreeIPA service confirms that the presented credentials did, in fact, originate from the trusted AD KDC and were not forged or tampered with.

The flaw: FreeIPA services (including the portal/web UI backend, SMB server, and LDAP directory service) are failing to validate the PAC signature. This is categorized as CWE-266 — Incorrect Privilege Assignment. Without PAC validation, the service accepts the authorization claims embedded in the Kerberos service ticket at face value.

Attack Surface: The attack surface is the entire FreeIPA identity realm where AD trust is configured:

• The FreeIPA web portal and its REST API
• The SMB server integration (for file sharing toward Windows clients)
• The LDAP directory interface

An attacker who is authenticated in AD (any domain user) can request a TGS ticket for FreeIPA services, but instead of presenting their own identity, they manipulate the client name (the cname field in the Kerberos ticket request and the corresponding name in the service ticket) to that of a privileged account — such as the admin user, a user with elevated privileges, or an account in a privileged IPA group (e.g., admins).

Because the PAC is not verified, the FreeIPA service unwittingly grants the privileges associated with the impersonated identity. The attacker does not need to know the target account's password or possess its TGT — they only need to be able to request a TGS in the name of that account.

Technical Note on Insufficient Detail: The NVD description does not specify which particular FreeIPA components (e.g., specific daemons, libraries, or Kerberos plugin modules) are affected. The vulnerability class is clearly "lack of PAC validation on the service side in a cross-realm trust," but the exact code path remains unspecified in public advisories. Sufficient technical detail to identify a specific vulnerable function is not available beyond the description provided.

Exploitation Scenarios

Prerequisite: Attacker must possess valid credentials for an Active Directory user account. The AD domain must have a configured trust relationship with FreeIPA (one-way or two-way). This is a common configuration in enterprises running hybrid Windows/Linux identity environments.

No public PoC exists. The following attack chain is inferred from the vulnerability class and Kerberos protocol mechanics.

Step 1 — Reconnaissance / Target Identification: The attacker, already possess g AD credentials, enumerates the FreeIPA environment. They may use tools like klist, kinit, or native Windows tools to discover:

• FreeIPA realm name (e.g., IPA.EXAMPLE.COM)
• The SPN (Service Principal Name) for FreeIPA services (e.g., HTTP/ipa.example.com)
• The domain trust relationship details (via nltest /domain_trusts or Get-ADTrust)

The attacker confirms the account names of high-privilege FreeIPA users (e.g., admin) — this is typically possible through LDAP queries to the FreeIPA directory if anonymous binding is restricted, or through social engineering and common role-based account naming conventions.

Step 2 — Flaw Class Trigger: The attacker requests a Ticket Granting Ticket (TGT) from the AD KDC for their own account. Then, rather than requesting a standard service ticket for FreeIPA services under their own identity, the attacker crafts a TGS-REQ (TGS request) in which the cname field (client name) is swapped for the privileged FreeIPA account name. Because the PAC validation is absent on the FreeIPA side, the service ticket is still accepted, and the authorization data is transparently trusted.

The trigger mechanism is specifically the TGS exchange — the attacker impersonates a client name during the request for a service ticket destined for FreeIPA services. This happens without needing the target account's long-term key material.

Step 3 — Payload/Execution Method: The attacker uses the forged/impersonated service ticket to authenticate to one of the affected FreeIPA services:

• Portal: HTTPS/HTTP requests to the FreeIPA web UI using curl or kinit with the manipulated credentials — grants access to the admin portal and allows user management, policy changes, or creating new Kerberos principals.
• SMB server: Mounting the SMB share as the impersonated user with elevated group memberships — allows unauthorized file read/write.
• LDAP directory: LDAP query/bind using GSSAPI with the impersonated ticket — grants read/write access to directory entries well beyond the attacker's actual permissions.

Step 4 — Post-Exploitation Impact: Once privilege escalation succeeds, the attacker effectively operates as a high-privileged FreeIPA admin. Post-exploitation activities include:

• Creating backdoor user accounts and Kerberos principals.
• Modifying sudo rules and host-based access control (HBAC) policies.
• Exporting the entire FreeIPA credential database or keytab material.
• Establishing persistent access through trust manipulation.
• Pivoting laterally to all hosts that trust FreeIPA for authentication (Linux servers, web applications using IPA LDAP, Kerberized services).

Impact Assessment

CVSS Analysis (9.6):

• Attack Vector: Network (AV:N) — Exploitable remotely from any reachable client.
• Attack Complexity: Low (AC:L) — No custom exploits or advanced techniques required; standardized Kerberos request modification.
• Privileges Required: Low (PR:L) — Only need an ordinary AD user account.
• User Interaction: None (UI:N) — No victim interaction required.
• Scope: Changed (S:C) — The compromised component (FreeIPA identity) is different from the impacted component (all relying services and the entire trust boundary).
• Confidentiality Impact: High (C:H) — Full access to all FreeIPA-stored directories, credentials (hashes, kerberos keytabs), and configuration data.
• Integrity Impact: High (I:H) — Ability to modify directory entries, add/remove accounts, alter policies, and manipulate trust settings.
• Availability Impact: None (A:N) — The vulnerability does not provide denial of service; an attacker gains full access but does not inherently cause an outage.

Business Impact:

• Confidentiality breach of the identity authority: FreeIPA is the identity source of truth in the Linux environment. A compromise of it implies a breach of every service, system, and application that relies on the identity store for authentication and authorization.
• Privilege escalation from non-privileged AD user to FreeIPA admin: The blast radius spans the entire FreeIPA domain and every subordinate system that trusts it.
• Regulatory non-compliance: Under PCI-DSS, GDPR, or SOX, an identity store compromise at this severity may constitute a reportable incident.

Affected Systems: All FreeIPA deployments with an AD trust relationship. Because no patch exists, all versions of FreeIPA at the time of this report are considered affected. Sufficient technical detail for affected version ranges is not publicly available.

Detection Guidance

Detecting this vulnerability is challenging because exploitation uses legitimate Kerberos tickets and does not necessarily trigger classic malware or payload marker signatures. Detection must focus on anomalies in TGS requests and unusual access patterns.

Sigma Rule

title: Suspicious TGS Impersonation Attempt Against FreeIPA Services
status: experimental
description: Detects TGS-REQ requests to FreeIPA SPNs where the client name does not match the originating user. Indicative of PAC-validation bypass attempt (CVE-2026-11861).
logsource:
  product: linux
  service: kerberos
detection:
  selection:
    event_name: 'TGS-REQ'
    service_principal:
      - 'HTTP/*'
      - 'ldap/*'
      - 'cifs/*'
  filter_normal:
    client_name: '%USERNAME%'
  condition: selection and not filter_normal
falsepositives:
  - Service account delegation scenarios (rare)
level: high
tags:
  - attack.t1078
  - attack.t1548

YARA Rule

rule FreeIPA_PAC_Impersonation_CVE_2026_11861
{
    meta:
        author = "Valter Sit Threat Intel"
        reference = "CVE-2026-11861"
        description = "Detects suspicious krb5 configuration or logs suggesting PAC validation bypass attempts"
        score = 60
    strings:
        $s1 = "verify_pac" ascii wide nocase
        $s2 = "pac_validation" ascii wide nocase
        $s3 = "cname" ascii wide nocase
        $s4 = "krb5" ascii wide nocase
        $s5 = "TGS" ascii wide
        $s6 = "ticket" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464c457f) and 
        (2 of ($s1, $s2, $s3)) and
        (1 of ($s4, $s5, $s6)) and
        (filesize > 10KB)
}

Suricata IDS Rule

alert tcp any any -> $FREEEIPA_SERVERS 389,636,88,89 (msg:"CVE-2026-11861 Potential TGS Impersonation - LDAP/Kerberos"; flow:established,to_server; content:"|6a|"; depth:1; content:"|81|"; within:50; content:"cname"; nocase; within:200; content:"TGS"; nocase; within:300; sid:202611861; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve 2026_11861, attack_target_tier 3, alert_type "Exploitation";)

Note: The above rule is heuristic given Kerberos traffic complexity; a custom MD5-based rule at the LDAP layer from a specific capture is preferred. Heuristic detection should trigger on abnormal Kerberos client name fields inside TGS tickets.

Elastic Detection

sequence by host.name, user.name with maxspan=5m
  [authentication where event.action == "ticket" and event.outcome == "success"
     and winlog.event_id == 4769 and winlog.event_data.ServiceName: "HTTP/*" or "ldap/*" or "cifs/*"
     and winlog.event_data.UserName != winlog.event_data.TargetUserName]

For a Linux/FreeIPA side view:

sequence with maxspan=20m
  [any where process.name : "kinit" or "krb5kdc"]
  [any where process.name : "klist" and event.action : "ticket*"]
  [any where event.dataset : "ldap" and event.action : "bind*" and user.name : "admin"]

Splunk SPL Query

index=kerberos sourcetype="kerberos:dc"
| search event_id=4769
| eval target_user = coalesce(user, winlog.EventData.TargetUserName)
| eval source_user = coalesce(src_user, winlog.EventData.UserName)
| search target_user != source_user
    AND (ServiceName=HTTP/* OR ServiceName=ldap/* OR ServiceName=cifs/*)
| stats count min(_time) max(_time) by target_user, source_user, ServiceName, Client_Address
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="freeipa,cve">
  <rule id="101861" level="12">
    <field name="event_name">TGS-REQ</field>
    <field name="service_principal">HTTP</field>
    <field name="client_name" type="pcre2">\.(?!\$)</field>
    <description>CVE-2026-11861: TGS request impersonation attempt against FreeIPA web service.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>freeipa</group>
    <options>no_full_log</options>
  </rule>
</group>

Note: These detection mechanisms are heuristic and may produce false positives; organizations should tune based on their environment and trust topology.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. There is no patch evidence from any tracked source at the time of writing. The vendor has not released a security update. Do not assume a future patch date or interim vendor workaround.

Immediate Mitigations (Until Patch Is Available):

1. Disable or restrict cross-forest trust: If the trust relationship is not operationally necessary, disable it immediately.
2. Restrict TGS requests: Deploy a firewall/ACL rule to restrict which clients can reach the FreeIPA Kerberos service (TCP/88, UDP/88) and only allow IP ranges from trusted management networks, not broad AD client segments.
3. Harden AD side: Apply a Windows Kerberos Group Policy to enforce PAC validation at the KDC for all cross-forest requests (Windows has hardening GPOs for this).
4. Credential protection: Rotate all privileged FreeIPA account passwords and keytab material — the flaw may permit impersonation without credential knowledge, so rotation is only partially effective.
5. Disable the SMB server on FreeIPA if not needed.

Patch/Upgrade Steps (When Available):

• Watch for FreeIPA security advisories from Red Hat and the FreeIPA project.
• Apply vendor patches immediately upon release.
• Back up the directory and config prior to upgrade (e.g., ipa-server-upgrade).

Long-term Hardening:

• Implement strict inter-realm policies — consider using a federated identity solution (e.g., Centrify, SSSD) instead of direct AD trust if the risk is unacceptable.
• Enforce the principle of least privilege — do not use the built-in admin account for service integration; create dedicated low-privilege accounts for SMB/LDAP integration.
• Enable comprehensive audit logging on the FreeIPA KDC and portal.
• Deploy SIEM-based correlation rules (above) as a compensating control.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-11861
2. FreeIPA Project Security Advisories: https://www.freeipa.org/page/Announcements (watch page — no advisory published for this CVE as of report date)
3. MITRE ATT&CK — Valid Accounts (T1078): https://attack.mitre.org/techniques/T1078/
4. Red Hat Product Security (FreeIPA is shipped in RHEL IdM): https://access.redhat.com/security/ (monitor for upcoming CVE-2026-11861 advisory)
5. Kerberos PAC specification (relevant background): https://datatracker.ietf.org/doc/draft-ietf-krb-wg-pac/

Threat Actor Activity / Exploit-in-the-Wild: No known threat actor campaigns have been associated with this CVE at the time of writing. No public exploit code or PoC evidence has been reported. Given the severity (9.6) and the simplicity of the attack (low complexity, low privilege), exploitation is considered highly likely in the future once PoC becomes public knowledge.