FreeIPA 4.13.4

FreeIPA 4.13.4#

The FreeIPA team would like to announce FreeIPA 4.13.4 release!

It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon.

Highlights in 4.13.4#

Security issues#

CVE-2026-79678: idp-add eval() reachable before authorization check allows environment disclosure and denial of service#

A flaw was found in FreeIPA’s idp-add command. ipapython.ipautil.template_str() evaluates any eval(…) token found in a post-substitution string using Python’s eval(). ipaserver/plugins/idp.py passes the caller-supplied –organization and –base-url values (ipaidporg/ipaidpbaseurl), which have no input validation, into this function via provider templates (okta, keycloak, microsoft). The LDAPCreate command framework runs this evaluation inside pre_callback, before the LDAP access control check that restricts idp-add to the ‘External IdP server Administrators’ privilege is ever evaluated. As a result, any authenticated IPA principal, regardless of privilege level, can trigger this evaluation.

Callbacks such as pre_callback run by the IPA API LDAP framework automatically. The fix is to apply permissions and ACIs checks to the authenticated IPA principal before any callbacks are executed.

This report prompted us to look at the overall access control checks in IPA API LDAP framework use. To fix similar issues in the framework overall, on top of LDAP access controls, we added an access control check to all IPA API operations. These checks take both ACL sources into account:

  • managed permissions defined in IPA plugins

  • implicit LDAP ACIs defined in LDAP

Managed permissions are associated with each LDAP object in IPA API and represent IPA API permissions and the privileges they can bear. Privileges associated with managed permissions are visible to administrators and membership can be added to grant permissions to administrators. The privileges converted into LDAP ACIs at runtime and updated every time new FreeIPA code is deployed.

CVE-2026-76578: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI#

Due to a bug in 389-ds directory server’s implementation of access controls, an unauthenticated LDAP client (anonymous bind or SASL ANONYMOUS) can create a self-managed OTP token entry with empty ipaTokenOwner/managedBy attributes, which satisfy 389 Directory Server’s SELFDN ACI evaluator against the anonymous bind’s own empty DN (see companion 389-ds flaw for that underlying defect). FreeIPA’s self-managed-token ACI (install/share/default-aci.ldif) does not restrict which other attributes may be added, allowing the client to inject an arbitrary attacker-chosen Kerberos principal that does not yet exist in the LDAP database. Mitigations introduced for CVE-2026-13097 fix does not allow overtaking existing accounts.

The attack may be used as a stepping stone to take over administrative privileges. Additional access controls hardening was applied to prevent follow up activities to elevate state of acquired credentials to administrative ones.

In order to address this vulnerability, FreeIPA and 389-ds teams had to review existing access controls implementation in both projects. On FreeIPA side the team chose to tighten up permissions guarding self-management access: the bare userdn = “ldap:///self” bind rule was replaced with (userdn = “ldap:///self” and userdn = “ldap:///all”) bind rule. The latter ensures that any user DN in an active LDAP bind matching the ldap:///self is also an authenticated one (e.g. ldap:///all). In anonymous LDAP binds the userdn is an empty string that cannot match ldap:///all

Bug fixes#

FreeIPA 4.13.4 is a stabilization release for the features delivered as a part of 4.13 version series.

There are multiple bug-fixes since FreeIPA 4.13.3 release. Details of the bug-fixes can be seen in the list of resolved tickets below.

Upgrading#

Upgrade instructions are available on Upgrade page.

Feedback#

Please provide comments, bugs and other feedback via the freeipa-users mailing list (https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/) or #freeipa channel on libera.chat.

Resolved tickets#

Detailed changelog since 4.13.3#

Alexander Bokovoy (35)#

  • vault: fix linting issues commit

  • vault: document why vaultconfig_show is intentionally ungated commit

  • cert: authorize certificate retrieval before reaching the RA agent commit

  • ca, certprofile: require CA Administrator before RA-agent changes commit

  • certmap: require privilege before matching certificates via SSSD commit

  • trust: require Replication Administrators before refreshing trust topology commit

  • baseldap: fall back to effective rights when enforcing managed permissions commit

  • admins: grant admins group all default privileges commit

  • trust_add: require Replication Administrators privilege commit

  • baseldap: force permission checks in LDAP-oriented operations commit

  • tests: xmlrpc: cover the permission authentication checks commit

  • tests: xmlrpc: expect the hardened self-service ACIs commit

  • tests: ipalib: cover parsing of absolute denies and compound bind rules commit

  • aci: regenerate ACI.txt for the permission changes commit

  • install: register the new 21-* ACI update scripts commit

  • aci: convert the self-service ACIs to the hardened bind rule on upgrade commit

  • aci: use the hardened self-service bind rule in the upgrade ACIs commit

  • aci: deny anonymous SID reads in the upgrade update commit

  • aci: deny all anonymous modifications in the upgrade update commit

  • aci: key the anonymous denies on the empty DN; harden the self-service rules commit

  • aci: generate the hardened self-service bind rule commit

  • aci: parse absolute denies and compound bind rules commit

  • otp: constrain the self-managed-token ADD to OTP object classes commit

  • trusts: scope Samba ipaNTHash ACI to cn=accounts commit

  • host: exclude ipaservers from delegated host-write permissions commit

  • group: read the SID only when authenticated; exclude protected groups from delegated writes commit

  • stageuser: exclude privileged accounts from delegated credential writes commit

  • user: read the SID only when authenticated; exclude privileged accounts from delegated writes commit

  • permission: require an authenticated bind for modification permissions commit

  • ipa-pwd-extop: fail closed if password metadata cannot be written commit

  • certprofile: reject import of profiles that can execute programs commit

  • kdb: enforce CNAME comparison against ipaOriginalUid in ID overrides commit #10041

  • Principal: implicitly convert to Principal for comparison commit

  • ipatests: Fix expectations in test_i18n_messages_valid commit

  • doc: update API change for principal from Str to Principal commit

David Hanina (1)#

  • Spec file: bump samba version to 4.23.11 for Fedora < 44 commit

Erik Belko (1)#

  • ipatests: Add ipa-getcert start-tracking tests commit #9968

Rafael Guterres Jeffman (1)#

  • Back to git snapshots commit

Stanislav Levin (1)#

Sudhir Menon (1)#