Privilege Escalation: PAC Omission in FreeIPA AD Trust
CVE-2026-11861 Published on August 20, 2026

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-11861 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

NONE

Timeline

2026-06-10

Reported to Red Hat.

2026-08-20

Made public. 71 days later.

Weakness Type

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Products Associated with CVE-2026-11861

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Enterprise Linux (RHEL)

Red Hat Enterprise Linux Eus

Red Hat Rhel E4s

Red Hat Rhel Eus

Red Hat Rhel Tus

Affected Versions

Red Hat Enterprise Linux 10:

Version 0:4.13.4-1.el10_2 and below * is unaffected.

Red Hat Enterprise Linux 10.0 Extended Update Support:

Version 0:4.12.2-15.el10_0.7 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 8100020261007071200.143e9e98 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 8100020261007070536.823393f5 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Telecommunications Update Service:

Version 8080020261007080925.e581a9e4 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Telecommunications Update Service:

Version 8080020261007071832.b0a6ceea and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions:

Version 8080020261007080925.e581a9e4 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions:

Version 8080020261007071832.b0a6ceea and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 0:4.13.4-1.el9_8 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions:

Version 0:4.10.1-12.el9_2.7 and below * is unaffected.

Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions:

Version 0:4.11.0-15.el9_4.9 and below * is unaffected.

Red Hat Enterprise Linux 9.6 Extended Update Support:

Version 0:4.12.2-14.el9_6.8 and below * is unaffected.

Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7:

Exploit Probability

EPSS

0.21%

Percentile

10.26%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.

Privilege Escalation: PAC Omission in FreeIPA AD TrustCVE-2026-11861 Published on August 20, 2026