CVE-2026-13097
CriticalCVSS 9.1Summary
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations, allowing a user with LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets and potential full domain compromise.
Risk Assessment
The risk includes potential takeover of service accounts and privilege escalation across the domain, potentially leading to full infrastructure compromise.
Recommendation
Apply vendor patches immediately and audit existing service principals for unauthorized entries.
Original NVD description (English source)
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.