CVE-2026-11861

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Published 20 Aug 2026, 11:16 UTC Last modified 20 Aug 2026, 11:16 UTC

9.6

CVSS 3.1 CRITICAL base score CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack profile

The conditions required to exploit this vulnerability and its potential impact.

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Scope Changed

Confidentiality High

Integrity High

Availability None

Exploitability3.1

Impact5.8

Affected products

Product applicability statements supplied with the NVD record.

NVD has not published structured affected-product data for this record.

Weakness classification

CWE categories help security teams group the underlying software weakness.

CWECWE-266

Source references

External advisories, patches and technical reports attached to this CVE record.

NVD National Vulnerability Database recordnvd.nist.gov 01 Technical reference secalert@redhat.com 02 Technical reference secalert@redhat.com