importantSYS.SOURCE: The Hacker News• 2026-09-08T16:52:07+05:30

Critical FreeIPA Vulnerability Chain Enables Unauthorized Administrator Credential Creation

#vulnerability #linux #cybersecurity #authentication #freeipa

A critical vulnerability chain in FreeIPA allows anonymous clients to create reusable administrator credentials by exploiting flaws in Kerberos identity management and 389 Directory Server access controls. The issue affects default installations and has been addressed in FreeIPA 4.13.4 and related components.

A flaw in FreeIPA lets a client that has never logged in create a Kerberos identity of its own choosing in the directory and end up in the administrators group, Red Hat says.

FreeIPA is the system that determines who may log in across a Linux domain and maintains all identities in a 389 Directory Server database accessed via LDAP. The attack needs a second flaw in that database software.

The

Read original article

*** END OF TRANSMISSION ***

> GOOGLE CHROME V8 ZERO-DAY EXPLOITED IN THE WILD FOR SANDBOX CODE EXECUTION > AI RESEARCHER JACOB COXON RESIGNS FROM ANTHROPIC, WARNS OF EXISTENTIAL RISKS > CRITICAL CPANEL VULNERABILITY ALLOWS PRIVILEGE ESCALATION VIA EMAILTRACK MODULE > F5 BIG-IP APM MALWARE EVADES DISK SCANS BY INJECTING PHP WEB SHELL INTO MEMORY > GPT-5.6 SOL'S APPLICATION IN QUANTUM COMPUTING EXPERIMENTS > THE PSYCHOLOGY OF MOTIVATION AND SCIENTIFIC PROGRESS > RESEARCHER DEMONSTRATES BYPASS OF MICROSOFT DEFENDER'S SHIELDBREAK PATCH VIA SHIELDCRASH VULNERABILITY > COPYRIGHT ABOLITION CLAIM AND MASTODON WEB APPLICATION TECHNICAL REQUIREMENTS > SAP ADDRESSES CRITICAL CVSS 10.0 VULNERABILITY IN KERNEL ALLOWING UNAUTHENTICATED RCE > TRADEMARK STATUS OF 'TWEET' AND BIRD LOGO IN X V. PROJECT BLUEBIRD CASE> GOOGLE CHROME V8 ZERO-DAY EXPLOITED IN THE WILD FOR SANDBOX CODE EXECUTION > AI RESEARCHER JACOB COXON RESIGNS FROM ANTHROPIC, WARNS OF EXISTENTIAL RISKS > CRITICAL CPANEL VULNERABILITY ALLOWS PRIVILEGE ESCALATION VIA EMAILTRACK MODULE > F5 BIG-IP APM MALWARE EVADES DISK SCANS BY INJECTING PHP WEB SHELL INTO MEMORY > GPT-5.6 SOL'S APPLICATION IN QUANTUM COMPUTING EXPERIMENTS > THE PSYCHOLOGY OF MOTIVATION AND SCIENTIFIC PROGRESS > RESEARCHER DEMONSTRATES BYPASS OF MICROSOFT DEFENDER'S SHIELDBREAK PATCH VIA SHIELDCRASH VULNERABILITY > COPYRIGHT ABOLITION CLAIM AND MASTODON WEB APPLICATION TECHNICAL REQUIREMENTS > SAP ADDRESSES CRITICAL CVSS 10.0 VULNERABILITY IN KERNEL ALLOWING UNAUTHENTICATED RCE > TRADEMARK STATUS OF 'TWEET' AND BIRD LOGO IN X V. PROJECT BLUEBIRD CASE