CVE-2026-13097

Katalog CVE

CVSS 8.7 · High EPSS 0,43%

Kerentanan Use of Incorrectly-Resolved Name or Reference pada redhat enterprise linux, freeipa. Skor CVSS 3.1 8.7 (High) menurut redhat.com.

Deskripsi (NVD)

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

Rincian

Terbit di NVD

20 Agustus 2026

Terakhir diubah

28 September 2026

Status NVD

Modified

CVSS 3.1

8.7 (High), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-706: Use of Incorrectly-Resolved Name or Reference

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-13097 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2515974 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:70564
• https://access.redhat.com/errata/RHSA-2026:72279