CVE-2026-79678 is a vulnerability in Red Hat Enterprise Linux (RHEL)
Published on September 7, 2026
Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.
Vulnerability Analysis
CVE-2026-79678 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and a high impact on availability.
Timeline
Reported to Red Hat.
Made public. 23 days later.
Weakness Type
What is an Eval Injection Vulnerability?
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). This may allow an attacker to execute arbitrary code, or at least modify what code can be executed.
CVE-2026-79678 has been classified to as an Eval Injection vulnerability or weakness.
Products Associated with CVE-2026-79678
Want to know whenever a new CVE is published for Red Hat Enterprise Linux (RHEL)? stack.watch will email you.