CVEFinder.io

CVE-2026-13097

⚠️ high
🔍 Scan for this CVE
Summary

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain

Description

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

CVSS Score
8.7
High
EPSS Score
0.3
Exploit Probability
Published Date
2026-08-20
First Seen: 2026-08-21
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 80.8% of all 350,976 vulnerabilities in our database.

#67,387
Top 25% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 21, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Red Hat would like to thank Vladislav Plyatsok (rd01f) for reporting this issue.
SSVC data provided by CISA
Last Modified 2026-08-27
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CWE IDs (Weakness Types)
CWE-706

📦 Affected Products 5

Vendor Product Status Affected Versions
redhat enterprise_linux Affected
v10.0
redhat enterprise_linux Affected
v7.0
redhat enterprise_linux Affected
v8.0
redhat enterprise_linux Affected
v9.0
freeipa freeipa Affected
v4.12.2

🔗 References 2

https://access.redhat.com/security/cve/CVE-2026-13097
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2515974
Issue Tracking Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-11861 ⛔ critical 9.6 0.2 A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Direct... 2026-08-20
CVE-2026-73196 🔶 medium 4.3 0.2 A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversize... 2026-08-20
CVE-2026-73197 ⚠️ high 7.5 0.3 A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form... 2026-08-20
CVE-2026-73198 ⚠️ high 7.5 0.3 A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` ... 2026-08-20
CVE-2026-19617 🔶 medium 5.5 0.1 A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration ... 2026-08-14
CVE-2026-58224 🔶 medium 6.5 0.3 A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of rec... 2026-08-14
These CVEs affect the same products