External risk intelligence

FreeIPA Self-Managed OTP Token ACI Allows Unauthenticated Administrator Group Membership.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-76578

FreeIPA is typically deployed as an identity management service intended for internal network infrastructure rather than direct public internet exposure. While it is network-reachable, its services are generally protected behind internal network controls and firewalls, making public internet exposure uncommon in standard enterprise deployments.

Missing Authentication

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A flaw in FreeIPA allows unauthenticated attackers to gain administrator privileges by exploiting a weakness in how self-managed OTP tokens and directory server ACIs are evaluated. This could lead to a complete compromise of identity management services and connected systems.

Unauthenticated access to FreeIPA administrator rights.
Allows attackers to control identity and access management.
Confirm relevance and assess exposure immediately.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a flaw in FreeIPA's self-managed OTP token configuration to gain administrator privileges without authentication. By sending a specially crafted LDAP request, an unauthenticated attacker can create a Kerberos principal and add it to the administrators group, allowing them to perform administrative actions within FreeIPA and related services.

No authentication required.
Create arbitrary administrator principal.
Gain administrator privileges.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could create a Kerberos principal and add it to the administrators group by exploiting a flaw in FreeIPA's self-managed OTP token ACI. This could allow the attacker to perform administrative operations on the directory and other identity management services.

Administrator group membership.
Unauthenticated LDAP client access.
Full administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in FreeIPA affects identity management services, making it critical for platform and infrastructure teams to address. The immediate priority is to identify all instances of FreeIPA, assess their reachability and business criticality, and confirm ownership. Once confirmed, a risk-based remediation plan, potentially involving coordination with the FreeIPA vendor, should be developed.

Platform and infrastructure teams own this.
Verify FreeIPA instance reachability and criticality.
Plan remediation based on risk and ownership.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FreeIPA?

FreeIPA is a comprehensive identity management solution used by organizations to centralize authentication, authorization, and account information. It provides a unified system for managing user identities, security policies, and Kerberos-based authentication across an enterprise environment, essentially acting as the gatekeeper for access to various networked resources and services.

What does CWE-306 mean for CVE-2026-76578?

CWE-306 refers to a Missing Authentication for Critical Function weakness. In the context of CVE-2026-76578, it means that a specific security control intended to manage OTP tokens fails to verify the identity of the user before allowing changes. Because this check is missing, the system mistakenly accepts requests from unauthenticated parties, enabling them to manipulate account privileges as if they were a trusted administrator.

How is this vulnerability triggered?

The flaw is triggered when an unauthenticated entity sends a specially crafted LDAP request to the directory server. The vulnerability specifically involves the self-managed OTP token access control settings. Importantly, this issue does not rely on a user already having a valid session or existing credentials; it is the lack of proper authentication requirements during the token handling process that allows the exploit to succeed.

Is my FreeIPA instance at risk?

According to Halo Surface Signal, FreeIPA is generally designed to operate within internal network infrastructure. While it is accessible via the network, it is typically protected by firewalls and internal controls, making it unlikely to be directly exposed to the public internet. You should determine if your specific instance bypasses these standard protections or is reachable from untrusted segments, as this increases the potential for unauthorized access.

What should I do if I run FreeIPA?

Begin by identifying all FreeIPA instances within your environment and verifying their current network reachability and business criticality. Once your inventory is confirmed, assess which systems are most sensitive. Coordinate with your security and platform teams to evaluate risk and prepare for remediation, prioritizing instances that are not adequately isolated by existing network security controls.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.