CVE-2026-19550

Executive Summary

CVE-2026-19550 is an incorrect-authorization vulnerability (CWE-863) in FreeIPA, the open-source identity management solution. The trust-fetch-domains command is protected by a read-only permission on the trust object instead of a trust-administration permission, which allows any authenticated, non-privileged IPA user to invoke a privileged Active Directory trust refresh while supplying attacker-controlled server and credential data. Successful exploitation results in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory, poisoning the integrity of the identity management backend. At the time of writing the vulnerability is unpatched (patch confidence 0/4), carries a CVSS score of 4.3 (Medium), and has a low EPSS score of 0.00193, indicating limited observed exploitation activity.

Technical Analysis

The root cause of CVE-2026-19550 is an incorrect authorization check (CWE-863) in the FreeIPA permission model. FreeIPA exposes a management command, trust-fetch-domains, which is designed to refresh the list of trusted domains and their associated ID ranges from a connected Active Directory forest/domain. This is a privileged administrative operation because the data it ingests is written into the IPA LDAP directory and directly affects how identity objects — users, groups, and their POSIX/domain IDs — are resolved and mapped across the trust boundary.

In a correctly designed permission model, such a state-mutating command would be gated behind a trust-administration permission, which is only granted to identity-management administrators. However, due to the flaw, the command is gated by a read-only permission on the trust object. This has two consequences:

1. The authorization boundary is lowered: any authenticated IPA user who can read the trust object is permitted to trigger the command. In FreeIPA, read access to trust objects is far more widely distributed than administration rights, meaning a large population of non-privileged accounts may satisfy the check.
2. The command accepts attacker-supplied inputs: the refresh operation can be pointed at an attacker-controlled "Active Directory" server endpoint and supplied with attacker-controlled credentials. Because the permission gate is incorrect, the normal administrative assumption — that only trusted administrators can feed data into the trust refresh — no longer holds.

The technical attack surface is the IPA command interface exposed to authenticated users over the network (CVSS vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). No user interaction is required, the attack requires only low-level privileges, and no confidentiality or availability impact is present. The integrity impact is rated low by the CVSS scoring, but the underlying object of that integrity impact — the trusted-domain and ID-range mappings in the central identity directory — is security-critical for any environment that relies on an Active Directory trust with FreeIPA.

Insufficient technical detail is available regarding the exact LDAP attributes, object classes, or command-line parameters involved; the NVD description provides no function names, endpoints, or specific class names beyond the trust-fetch-domains command. The vulnerability class, however, is clear: a state-changing, security-relevant administrative operation is exposed to entities that should not have authorization to invoke it, and the operation can be fed with attacker-controlled data.

Exploitation Scenarios

No public PoC or exploit code has been identified for CVE-2026-19550. The attack chain below is inferred from the vulnerability class described in the NVD entry and should be treated as an analytical reconstruction rather than a confirmed exploit procedure.

1. Reconnaissance and target identification. The attacker identifies a FreeIPA deployment that has an Active Directory trust configured. Target identification can be performed by fingerprinting the FreeIPA web UI or LDAP endpoints. The attacker also needs a valid, low-privileged IPA user account — no administrative rights are required. Such credentials could be obtained through phishing, credential stuffing, or from an already-compromised endpoint joined to the IPA domain.

2. Flaw-class triggering. The attacker invokes the trust-fetch-domains command as the low-privileged authenticated user. Because the command is gated by a read-only permission on the trust object rather than a trust-administration permission, the authorization check succeeds even though the user holds no trust administration rights. No payload exploits a memory-corruption or injection bug; the flaw is purely a logical authorization bypass.

3. Payload/execution method at the vulnerability-class level. During invocation, the attacker supplies a server endpoint and credential pair of their choosing. Rather than referencing the legitimate Active Directory infrastructure, the attacker points the trust refresh at an attacker-controlled LDAP/AD-compatible service. The privileged trust-refresh routine then consumes the attacker-supplied data as though it were authoritative domain and ID-range information. Insufficient technical detail is available to specify the exact request format or protocol fields; the attack succeeds because the command trusts its inputs and the authorization gate is too weak.

4. Post-exploitation impact. The attacker-controlled data is written into trusted-domain and ID-range entries in the IPA LDAP directory. This corrupts the mapping between Active Directory security identifiers and the POSIX/ID-range values used by FreeIPA to resolve identities. Potential downstream effects include: ID-range collisions or overlaps that misassociate users and groups; broken or manipulated group membership resolution; confusion of account ownership during authentication and authorization decisions; and general degradation of integrity in the identity backbone that the entire domain relies upon.

The combination of a network-accessible surface, low required privileges, and no public PoC means the realistic near-term exploitation risk is moderate, consistent with the low EPSS score (0.00193; 9.2nd percentile of exploited CVEs).

Impact Assessment

CVSS analysis. The base score of 4.3 (Medium) reflects: network attack vector (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), low integrity impact (I:L), and no availability impact (A:N). The score is moderate because the attacker requires valid low-privileged credentials and because the direct data-integrity damage is scored as limited. However, the downstream consequences of identity-data poisoning in an identity management platform can exceed what the raw score suggests.

Business impact. FreeIPA is frequently deployed as the authoritative identity provider for Linux fleets, and its Active Directory trust integration is used to unify authentication and authorization between the Unix world and corporate AD domains. Corruption of trusted-domain and ID-range data does not merely produce bad data; it can break identity resolution, produce ID conflicts, and undermine the integrity of access decisions across all connected systems. In a compliance-sensitive environment, this constitutes a violation of access-control integrity that auditors and incident responders must treat seriously.

Affected systems and blast radius. Any FreeIPA deployment with an Active Directory trust configured is potentially affected. The exact affected version range has not been published; as such, enterprises should assume broad exposure across current FreeIPA releases. The blast radius includes all components that consume trust-derived identity data: IPA replicas, enrolled hosts performing identity lookups, Kerberos/KDC services, sudo rules, and any downstream system consuming LDAP identity data.

Exploitation outlook. With patch confidence at 0/4, no vendor fix, and no workaround published, affected organizations face an indefinite window of exposure. The low EPSS percentile suggests attackers have not yet weaponized this flaw at scale, but the low privilege requirement and network reachability make it an attractive candidate for targeted exploitation by actors interested in poisoning identity infrastructure.

Detection Guidance

The detections below focus on three observable artifacts of this vulnerability class: (1) execution of the trust-fetch-domains command by non-administrative users, (2) abnormal LDAP write operations targeting trust/domain/ID-range data in the IPA directory, and (3) command invocations referencing unusual or external server endpoints. Because no implementation details beyond the command name are disclosed in the CVE data, rules are kept at the command- and event-class level.

Sigma Rule

title: FreeIPA trust-fetch-domains Command Execution - Possible CVE-2026-19550
id: 8f35c9a1-4e2b-4f7d-9c3a-6b10d2a4e8f0
status: experimental
description: >
    Detects execution of the FreeIPA 'trust-fetch-domains' command.
    This command performs a privileged Active Directory trust refresh and is
    authorized by a read-only trust permission in CVE-2026-19550, allowing
    non-privileged authenticated users to trigger attacker-controlled
    modification of trusted-domain and ID-range data in the IPA LDAP directory.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-19550
tags:
    - attack.t1068
    - attack.privilege_escalation
    - cve.2026-19550
logsource:
    category: process_creation
    product: linux
detection:
    selection_cmd:
        CommandLine|contains: trust-fetch-domains
    selection_ipa:
        CommandLine|contains|all:
            - ipa
            - trust
    condition: selection_cmd and selection_ipa
falsepositives:
    - Legitimate administrative use by authorized IPA trust administrators
level: medium

YARA Rule

rule FreeIPA_TrustFetchDomains_Abuse
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects log/script references to the FreeIPA trust-fetch-domains command associated with CVE-2026-19550"
        cve = "CVE-2026-19550"
        date = "2026-01-01"
    strings:
        $s1 = "trust-fetch-domains" ascii wide
        $s2 = "trust-fetch" ascii wide
        $s3 = "ID-range" ascii wide
        $s4 = "trusted-domain" ascii wide
    condition:
        uint16(0) == 0x5A4D or any of them
}

Suricata IDS Rule

alert tcp any any -> any 389 (msg:"CVE-2026-19550 FreeIPA Potential Unauthorized Trust Object Modification via LDAP"; flow:established,to_server; content:"|66|"; depth:2; content:"trust"; within:200; reference:cve,2026-19550; classtype:attempted-admin; sid:20261950; rev:1;)

Note: The rule targets LDAP modify operations (protocol tag 0x66) whose payload references trust objects, which is the underlying mechanism through which attacker-controlled trust-refresh data is written to the IPA LDAP directory. Tune the destination port and asset group to your FreeIPA/LDAP infrastructure.

Elastic Detection

process where process.command_line : "*trust-fetch-domains*"

Extended EQL variant with account-context alerting:

process where process.command_line : ("*trust-fetch-domains*") and not user.name : "*admin*"

Splunk SPL Query

index=linux (sourcetype=linux_audit OR sourcetype=process_events OR sourcetype=auditd)
| where match(cmdline, "trust-fetch-domains") OR match(process, "trust-fetch-domains") OR match(command, "trust-fetch-domains")
| eval threat="CVE-2026-19550 FreeIPA trust-fetch-domains abuse"
| table _time, host, user, cmdline, process, auid
| sort - _time

Wazuh OSSEC Rule

<group name="freeipa,cve-2026-19550,">
    <rule id="100195" level="12">
        <match>trust-fetch-domains</match>
        <description>FreeIPA trust-fetch-domains command executed - possible CVE-2026-19550 unauthorized trust refresh</description>
        <mitre>
            <id>T1068</id>
        </mitre>
        <group>privilege_escalation,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No patch, vendor fix, or upstream advisory is available from any tracked source as of the writing of this report. The affected version range has not been published, so all FreeIPA deployments with Active Directory trust should be assumed exposed.

1. Immediate mitigations (until a patch is available):

   • Restrict execution of the trust-fetch-domains command at the RBAC layer. Define a custom FreeIPA role that explicitly denies non-administrative users and groups the ability to run trust-refresh operations; verify the effective permissions on the trust object.
   • If the Active Directory trust is not an active business requirement, disable the trust-fetch-domains functionality entirely and remove or disable the read permission on the trust object for non-admin roles.
   • Segment and firewall the FreeIPA LDAP and management interfaces so that only administrative networks can reach them; do not expose them to the broad corporate network.
   • Enable and monitor audit logging (including FreeIPA audit log, system auditd, and LDAP access logging) so that any invocation of trust-fetch-domains is immediately visible to the SOC.
   • Review current trust-object ACLs and reduce read access to the minimal set of users who genuinely require it.

2. Patch/upgrade steps:

   • Monitor the FreeIPA project release feed, the FreeIPA bug tracker, and Red Hat security advisories for a patch referencing CVE-2026-19550.
   • Because the CNA has not published an affected version range, plan an upgrade path that applies the patched FreeIPA release as soon as it is announced; test the upgrade in a staging environment before production rollout.
   • After patching, verify that the permission model now requires a trust-administration permission for the trust-fetch-domains command.

3. Long-term hardening:

   • Perform a periodic audit of FreeIPA permission and role definitions, specifically checking that state-mutating commands are not gated by read-only permissions (CWE-863 class).
   • Enforce least privilege for all IPA service accounts and enrolled hosts; rotate credentials of any account that could have been used to trigger the flaw.
   • Harden AD trust configurations: restrict which servers and credentials can be used in trust refresh operations, and monitor for unexpected changes to trusted-domain and ID-range entries.
   • Integrate FreeIPA audit logs into the SIEM and establish alerting for any modification of identity/ID-range data by non-administrative principals.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-19550
• CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2026-19550
• FreeIPA Project: https://www.freeipa.org
• MITRE ATT&CK Technique T1068: https://attack.mitre.org/techniques/T1068/

Threat actor campaigns and exploit-in-the-wild evidence: none identified at the time of writing. CISA KEV does not list this CVE. No public PoC, Nuclei template, or exploit code has been observed. Continued monitoring of the FreeIPA upstream and security mailing lists is recommended, as the publication of a working exploit would significantly alter the risk posture.