CVE-2026-11861 Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

What is CVE-2026-11861?

CVE-2026-11861 is a critical authentication bypass vulnerability in Redhat Enterprise Linux, published on 20 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Weakness: CWE-266

Which versions are affected by CVE-2026-11861?

It affects 2 products.

Products include Freeipa Freeipa, Redhat Enterprise Linux.

How do I fix CVE-2026-11861?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-11861 being exploited?

There is no known exploitation of CVE-2026-11861 in the wild and no public exploit code.

Other vulnerabilities in Redhat Enterprise Linux

• CVE-2015-5284 Information disclosure in n/a Critical 9.8
• CVE-2024-2698 Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service High 8.8
• CVE-2012-5631 Information disclosure in ipa High 8.8
• CVE-2017-11191 Security feature bypass in n/a High 8.8
• CVE-2026-13097 Privilege escalation in Red Hat Enterprise Linux 10 High 8.7

All Redhat Enterprise Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-11861, GHSA-g67c-jg9c-rqh2, UBUNTU-CVE-2026-11861.