CVE-2026-79678 Code injection in Red Hat Enterprise Linux 10
Authenticated users can exploit eval() in idp-add to read server environment variables and cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-79678?
CVE-2026-79678 is a high-severity code injection vulnerability in Red Hat Enterprise Linux 10, published on 7 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.
Weakness: CWE-95
Which versions are affected by CVE-2026-79678?
How do I fix CVE-2026-79678?
Apply the vendor's patch.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-79678 being exploited?
There is no known exploitation of CVE-2026-79678 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-79678, GHSA-2rwh-2wx9-4qwh, UBUNTU-CVE-2026-79678.