CVE-2026-11861
CriticalCVSS 9.6Summary
A flaw was found in FreeIPA. When a trust relationship is configured with Active Directory, AD users can bypass authentication for FreeIPA services by impersonating a client name in the TGS due to missing PAC certificate verification. This could allow an authenticated AD user to escalate privileges within the FreeIPA domain.
Risk Assessment
The risk includes unauthorized access to FreeIPA services by AD users and potential privilege escalation, threatening domain integrity.
Recommendation
Update FreeIPA to a patched version and enforce PAC certificate verification for all services.
Original NVD description (English source)
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.