Skip to content
Fencer Vulns
high 8.2

CVE-2026-19550 json

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

published 2026-08-11 2 mo ago modified 2026-11-04 4 d ago also EUVD-2026-56977

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:4.13.4-1.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:4.12.2-15.el10_0.7
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:4.6.8-5.el7_9.25
  • Red Hat Red Hat Enterprise Linux 8 8100020261007070536.823393f5, 8100020261007071200.143e9e98
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020261027121250.f153676a, 8040020261027121355.5b01ab7e
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020261027121250.f153676a, 8040020261027121355.5b01ab7e
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020261008133528.ada582f1, 8060020261008134123.c1533a64
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020261008133528.ada582f1, 8060020261008134123.c1533a64
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020261007071832.b0a6ceea, 8080020261007080925.e581a9e4
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020261007071832.b0a6ceea, 8080020261007080925.e581a9e4
  • Red Hat Red Hat Enterprise Linux 9 0:4.13.4-1.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:4.10.1-12.el9_2.7
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:4.11.0-15.el9_4.9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:4.12.2-14.el9_6.8
  • ipa RHEL 8 4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
  • pyusb RHEL 8 1.0.0-9.1.module+el8.9.0+18920+2223d05e
  • softhsm RHEL 8 2.6.0-5.module+el8.9.0+18911+94941f82
  • custodia RHEL 8 0.6.0-3.module+el8.9.0+18911+94941f82
  • slapi-nis RHEL 8 0.60.0-4.module+el8.10.0+20723+03062ebd
  • ipa-client RHEL 8 4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
  • ipa-common RHEL 8 4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
  • ipa-server RHEL 8 4.9.13-21.module+el8.10.0+25041+701625f4.3

red hat advisories RHSA-2026:83460RHSA-2026:83461RHSA-2026:83085RHSA-2026:83083RHSA-2026:83084RHSA-2026:82935

  • softhsm AlmaLinux 8 2.6.0-5.module_el8.6.0+2881+2f24dc92
  • softhsm AlmaLinux 8 2.6.0-5.module_el8.6.0+3031+2f24dc92
  • custodia AlmaLinux 8 0.6.0-3.module_el8.6.0+2881+2f24dc92
  • slapi-nis AlmaLinux 8 0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1
  • ipa-client AlmaLinux 8 4.9.13-21.module_el8.10.0+4302+2d2000af.3
  • ipa-common AlmaLinux 8 4.9.13-21.module_el8.10.0+4302+2d2000af.3
  • ipa-server AlmaLinux 8 4.9.13-21.module_el8.10.0+4302+2d2000af.3
  • opendnssec AlmaLinux 8 2.1.7-2.module_el8.10.0+3980+d78e8e90

almalinux advisories ALSA-2026:83460ALSA-2026:72279ALSA-2026:70564

  • ipa Rocky Linux 8 4.9.13-21.module+el8.10.0+40089+03bf3c1f
  • ipa Rocky Linux 8 4.9.13-21.module+el8.10.0+40090+e6f37a74
  • pyusb Rocky Linux 8 1.0.0-9.1.module+el8.9.0+1372+09f67869
  • pyusb Rocky Linux 8 1.0.0-9.1.module+el8.9.0+1371+ffa84eb9
  • softhsm Rocky Linux 8 2.6.0-5.module+el8.9.0+1371+ffa84eb9
  • custodia Rocky Linux 8 0.6.0-3.module+el8.9.0+1371+ffa84eb9
  • slapi-nis Rocky Linux 8 0.60.0-4.module+el8.9.0+1573+39ab85f4
  • opendnssec Rocky Linux 8 2.1.7-2.module+el8.10.0+1960+1ed527b3

rocky linux advisories RLSA-2026:83460RLSA-2026:72279RLSA-2026:70564

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-19550 updated cvss 8.2

freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes

  • Red Hat CodeReady Linux Builder EUS (v.9.6) python3-ipatests 4.12.2-14.el9_6.8
    fixed: vendor fix RHSA-2026:83083
  • Red Hat Enterprise Linux AppStream (v. 8) pyusb 1.0.0-9.1.module+el8.9.0+18911+94941f82, pyusb 1.0.0-9.1.module+el8.9.0+18920+2223d05e, softhsm 2.6.0-5.module+el8.9.0+18911+94941f82, custodia 0.6.0-3.module+el8.9.0+18911+94941f82, ipa 4.9.13-21.module+el8.10.0+25041+701625f4.3, ipa 4.9.13-21.module+el8.10.0+25042+a3bddcd5.3, +50 more
    fixed: vendor fix RHSA-2026:83460
  • Red Hat Enterprise Linux AppStream (v. 9) ipa 4.13.4-1.el9_8, ipa-client 4.13.4-1.el9_8, ipa-common 4.13.4-1.el9_8, ipa-server 4.13.4-1.el9_8, ipa-selinux 4.13.4-1.el9_8, ipa-client-epn 4.13.4-1.el9_8, +12 more
    fixed: vendor fix RHSA-2026:70564
  • Red Hat Enterprise Linux AppStream (v. 10) ipa 4.13.4-1.el10_2, ipa-client 4.13.4-1.el10_2, ipa-common 4.13.4-1.el10_2, ipa-server 4.13.4-1.el10_2, ipa-selinux 4.13.4-1.el10_2, ipa-client-epn 4.13.4-1.el10_2, +12 more
    fixed: vendor fix RHSA-2026:72279
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.9.2-10.module+el8.4.0+25230+139d38e7.6, ipa 4.9.2-10.module+el8.4.0+25231+beff12c5.6, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix RHSA-2026:93452
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.9.8-13.module+el8.6.0+25053+bc39327b.4, ipa 4.9.8-13.module+el8.6.0+25054+4a5dd89b.4, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix RHSA-2026:89836
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) custodia 0.6.0-3.module+el8.1.0+4098+f286395e, ipa 4.9.11-11.module+el8.8.0+25043+cab6964c.6, ipa 4.9.11-11.module+el8.8.0+25045+e21657cc.6, pyusb 1.0.0-9.1.module+el8.7.0+15690+c8d45780, pyusb 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix RHSA-2026:83461
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) ipa 4.10.1-12.el9_2.7, ipa-client 4.10.1-12.el9_2.7, ipa-common 4.10.1-12.el9_2.7, ipa-server 4.10.1-12.el9_2.7, ipa-selinux 4.10.1-12.el9_2.7, ipa-client-epn 4.10.1-12.el9_2.7, +8 more
    fixed: vendor fix RHSA-2026:83085
show 11 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) ipa 4.11.0-15.el9_4.9, ipa-client 4.11.0-15.el9_4.9, ipa-common 4.11.0-15.el9_4.9, ipa-server 4.11.0-15.el9_4.9, ipa-selinux 4.11.0-15.el9_4.9, ipa-client-epn 4.11.0-15.el9_4.9, +8 more
    fixed: vendor fix RHSA-2026:83084
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) ipa 4.12.2-15.el10_0.7, ipa-client 4.12.2-15.el10_0.7, ipa-common 4.12.2-15.el10_0.7, ipa-server 4.12.2-15.el10_0.7, ipa-selinux 4.12.2-15.el10_0.7, ipa-client-epn 4.12.2-15.el10_0.7, +12 more
    fixed: vendor fix RHSA-2026:82935
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) ipa 4.12.2-14.el9_6.8, ipa-client 4.12.2-14.el9_6.8, ipa-common 4.12.2-14.el9_6.8, ipa-server 4.12.2-14.el9_6.8, ipa-selinux 4.12.2-14.el9_6.8, ipa-client-epn 4.12.2-14.el9_6.8, +12 more
    fixed: vendor fix RHSA-2026:83083
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.9.2-10.module+el8.4.0+25230+139d38e7.6, ipa 4.9.2-10.module+el8.4.0+25231+beff12c5.6, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix RHSA-2026:93452
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.9.8-13.module+el8.6.0+25053+bc39327b.4, ipa 4.9.8-13.module+el8.6.0+25054+4a5dd89b.4, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix RHSA-2026:89836
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) custodia 0.6.0-3.module+el8.1.0+4098+f286395e, ipa 4.9.11-11.module+el8.8.0+25043+cab6964c.6, ipa 4.9.11-11.module+el8.8.0+25045+e21657cc.6, pyusb 1.0.0-9.1.module+el8.7.0+15690+c8d45780, pyusb 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix RHSA-2026:83461
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3-ipatests 4.13.4-1.el9_8
    fixed: vendor fix RHSA-2026:70564
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-ipatests 4.13.4-1.el10_2
    fixed: vendor fix RHSA-2026:72279
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) python3-ipatests 4.12.2-15.el10_0.7
    fixed: vendor fix RHSA-2026:82935
  • Red Hat Enterprise Linux Server (v. 7 ELS) ipa 4.6.8-5.el7_9.25, ipa-client 4.6.8-5.el7_9.25, ipa-common 4.6.8-5.el7_9.25, ipa-server 4.6.8-5.el7_9.25, ipa-server-dns 4.6.8-5.el7_9.25, python2-ipalib 4.6.8-5.el7_9.25, +6 more
    fixed: vendor fix RHSA-2026:93071
  • Red Hat Enterprise Linux 6 ipa, ipa-client, ipa-python, ipa-server, ipa-admintools, ipa-server-selinux, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.