CVE-2026-19550: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-19550 is an incorrect authorization vulnerability in FreeIPA (Red Hat Identity Management) affecting the trust-fetch-domains command. The flaw allows any authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using attacker-supplied server and credentials, resulting in unauthorized modification of trusted-domain and ID-range identity data in the IPA LDAP directory. It was reported by Andrew Rukin (Arenadata) and disclosed on August 11, 2026. Only FreeIPA/IdM servers with an Active Directory cross-forest trust configured (via ipa-adtrust-install and ipa trust-add) are affected. The CVSS v3.1 base score is 4.3 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-863 (Incorrect Authorization): the trust-fetch-domains command is gated by the System: Read Trust Information ACI, which is granted to all authenticated IPA users by default, rather than a trust-administration-level permission (Red Hat CVE). When invoked, the command calls a root-owned oddjobd/D-Bus helper (install/oddjob/com.redhat.idm.trust-fetch-domains.in); if the caller supplies --admin/--password and --server, the helper performs kinit_password() against the attacker-chosen server with no validation that the credentials belong to the legitimate trusted AD forest (Red Hat Bugzilla). The fabricated forest-trust topology (domain names, NetBIOS names, SIDs) returned by the attacker-controlled server is then written directly into the IPA LDAP directory as authoritative trust/ID-range data via trust.add_new_domains_from_trust(). The authorization gap was confirmed against ipa-server-4.13.5 in an isolated sandbox (Red Hat Bugzilla).

Successful exploitation allows an authenticated but non-privileged IPA user to corrupt trusted-domain and ID-range identity data stored in the IPA LDAP directory, impacting the integrity of the identity infrastructure. This could result in incorrect SID-to-user mappings, disrupted cross-forest trust relationships, or manipulation of ID ranges used for user/group resolution across the AD trust boundary. There is no confidentiality or availability impact per the CVSS scoring, but integrity compromise of trust topology data could facilitate privilege escalation or identity spoofing in environments relying on the AD trust (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the disclosure date (Red Hat CVE). The EPSS score is approximately 0.193%, placing it in the 9th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid, non-privileged IPA user account and network reachability from the IdM server to attacker-controlled infrastructure, making the attack relatively low-complexity for insiders or users with any level of IPA access on affected deployments.

1. Identify a target: Confirm the target FreeIPA/IdM server has an Active Directory cross-forest trust configured (i.e., ipa-adtrust-install was run and ipa trust-add was used to establish a trust).
2. Obtain a non-privileged IPA account: Acquire any valid, authenticated IPA user account — no administrative privileges are required.
3. Set up attacker-controlled infrastructure: Deploy a rogue server that mimics an Active Directory domain controller and can respond to Kerberos authentication and DCERPC/LSA trust topology queries with fabricated data (custom domain names, NetBIOS names, SIDs).
4. Invoke trust-fetch-domains with attacker-supplied parameters: Authenticate to the IPA server and run: ipa trust-fetch-domains --server <attacker-controlled-server> --admin <attacker-user> --password <attacker-password> <trust-domain>. The System: Read Trust Information ACI grants the non-privileged user access to invoke this command.
5. Trigger privileged helper execution: The IPA server's root-owned oddjobd/D-Bus helper (com.redhat.idm.trust-fetch-domains) performs kinit_password() against the attacker-supplied server without validating that the credentials belong to the legitimate trusted AD forest.
6. Inject fabricated trust topology: The attacker-controlled server returns crafted forest-trust topology data (domain names, NetBIOS names, SIDs) via DCERPC, which is accepted by ipaserver/dcerpc.py's fetch_domains()/discover_trust_instance().
7. Achieve unauthorized LDAP writes: The fabricated data is written into the IPA LDAP directory as authoritative trust/ID-range topology by trust.add_new_domains_from_trust(), corrupting identity mappings (Red Hat Bugzilla).

• Logs: IPA server logs showing ipa trust-fetch-domains invocations by non-administrative user accounts; oddjobd/D-Bus logs showing com.redhat.idm.trust-fetch-domains helper execution triggered by non-admin principals; Kerberos KDC logs showing kinit attempts against unexpected or external servers.
• Network: Outbound DCERPC/LSA (TCP 445, 135, or dynamic RPC ports) or Kerberos (UDP/TCP 88) connections from the IdM server to IP addresses not belonging to the known, legitimate Active Directory domain controllers.
• LDAP Directory: Unexpected or unauthorized changes to trust topology objects (e.g., cn=trusts,dc=...) or ID-range objects in the IPA LDAP directory, particularly new or modified domain names, NetBIOS names, or SIDs not corresponding to the legitimate AD forest.
• Process: Unusual invocations of the oddjobd helper process with --server arguments pointing to non-standard or external hosts (Red Hat Bugzilla, Red Hat CVE).

A patch is available for FreeIPA/IdM; administrators should update to the fixed version as the primary remediation (Red Hat CVE). As a compensating control, administrators can restrict the default System: Read Trust Information permission so it is no longer granted to all authenticated users — this reduces the attack surface by preventing non-admin users from invoking trust-fetch-domains. Red Hat cautions that this permission may be relied upon by other legitimate read-only operations (e.g., SSSD subdomain support), so the change should be tested before applying in production. Servers without an Active Directory cross-forest trust configured are not affected and require no action (Red Hat CVE).

Red Hat credited Andrew Rukin of Arenadata for responsibly reporting this issue (Red Hat CVE). The vulnerability was classified as moderate severity by both Red Hat and GitHub Advisory Database. No significant broader media coverage or notable researcher commentary beyond the official advisory and bugzilla report has been observed at this time.