CVE-2026-11861 is a critical flaw (CVSS 9.6) in FreeIPA. When FreeIPA has a trust with Active Directory, an authenticated AD user can impersonate another client name and bypass authentication for FreeIPA services. Red Hat's RHSA-2026:70564 ships the fix for RHEL 9 as ipa 4.13.4-1.el9_8.
What's affected
- FreeIPA deployments that have a trust relationship configured with Active Directory. The record lists freeipa and Red Hat Enterprise Linux as affected products.
- The services named in the record are the FreeIPA portal, the SMB server and the LDAP directory.
- Fixed build per Red Hat erratum RHSA-2026:70564: ipa 4.13.4-1.el9_8, for the RHEL 9 and RHEL 9.8 channels. The affected packages include ipa-server, ipa-client, python3-ipaserver and python3-ipalib.
- The record points at five more errata (RHSA-2026:72279, 82935, 83083, 83084 and 83085). I read only the first one, so check the others against the RHEL stream you run.
On severity: the record scores this 9.6 Critical. The Red Hat erratum rates the advisory as Critical and does not list a separate CVE score on the page I read, so the two sources agree in direction.
How to check if you're exposed
Start by finding out whether you use a trust at all. A FreeIPA server with no AD trust is outside the scenario the record describes.
ipa trust-find
rpm -q ipa-server ipa-client
The first command lists configured trusts on an IPA server. The second shows the installed package build on RHEL. Compare the result with ipa 4.13.4-1.el9_8 or the build in the erratum for your stream. If you run another distribution that packages FreeIPA, check that vendor's advisory, because I did not confirm fixed versions outside Red Hat.
What to do now
- Inventory every FreeIPA server and note which ones have an AD trust.
- Apply the Red Hat update from RHSA-2026:70564 (or the erratum that matches your RHEL stream) on servers and clients, following Red Hat's standard update instructions.
- Red Hat lists no mitigation for this CVE, so do not rely on a workaround. Plan the update window instead.
- Review authentication logs on FreeIPA services for unexpected logins by AD users since the trust was created.
- Re-scan your fleet's package inventory after patching to confirm no host still carries an older build.
Why it matters
The weakness is classed as CWE-266 (Incorrect Privilege Assignment). According to the record, FreeIPA services did not verify the Privilege Attribute Certificate (PAC) carried in a Kerberos ticket. Without that check, a service trusts the client name in the Ticket Granting Service request. An AD user who can impersonate a client name therefore gets treated as someone else.
The CVSS vector shows why the score is high. The attack is network based, needs only a low privilege account, and changes scope, with high confidentiality and integrity impact. The record does not list this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. Cross-realm trusts concentrate identity trust in one place, so a flaw here deserves quick patching even without exploitation reports.
Quick check
Does this affect FreeIPA without an Active Directory trust?
The record describes the issue only for setups where a trust between FreeIPA and Active Directory is configured. Confirm with your vendor if you are unsure.
Is there a workaround?
Red Hat lists no mitigation for this CVE. The guidance is to apply the update.
Sources
Last reviewed: 18 October 2026.
