CVE-2026-79678

Summary

A flaw was found in FreeIPA's idp-add command, where insufficiently validated –organization/–base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 100:4.13.4-1.el10_2 < *unaffected
Red HatRed Hat Enterprise Linux 90:4.13.4-1.el9_8 < *unaffected

Weaknesses

  • CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Workarounds

There is no configuration-based mitigation that prevents an authenticated but unprivileged principal from reaching the affected code path; upgrading to a fixed package is required once available. Administrators of container-based deployments should verify that credentials supplied via the PASSWORD environment variable during initial container setup do not persist in the running server process's environment.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References