CVE-2026-73199: 
Samba vulnerability analysis and mitigation

CVE-2026-73199 is a NULL Pointer Dereference vulnerability in the ipa-enrollment SLAPI plugin of Red Hat's FreeIPA (Identity, Policy, and Audit) software. A remote authenticated client can trigger a server crash by sending a malformed LDAP extended operation that omits the request value for the JOIN_OID parameter, resulting in a denial of service. The vulnerability affects ipa-4.13.1-3.el10 on Red Hat Enterprise Linux 10 where the ipa-enrollment SLAPI plugin is enabled. It was reported on May 11, 2026, and publicly disclosed on August 20, 2026, with a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference) and resides in the ipa_join() function within daemons/ipa-slapi-plugins/ipa-enrollment/ipa_enrollment.c. After routing a JOIN_OID extended operation request through ipaenrollment_extop(), the code calls slapi_pblock_get() to retrieve SLAPI_EXT_OP_REQ_VALUE and then immediately dereferences extop_value->bv_val to build an LDAP search filter — without first checking whether the request value is present. Exploitation requires: (1) a deployment running ipa-4.13.1-3.el10 with the ipa-enrollment SLAPI plugin enabled, (2) an LDAP connection over a secure channel (StartTLS or LDAPS) with SSF greater than 1, and (3) authentication as a non-anonymous user. The proposed fix is to validate extop_value immediately after retrieval and return LDAP_PROTOCOL_ERROR if it is NULL or empty (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation causes a crash of the FreeIPA Directory Server process, resulting in a complete loss of availability for the LDAP service — which is central to authentication, authorization, and host enrollment in FreeIPA-managed environments. There is no established confidentiality or integrity impact; the vulnerability cannot be used to read or modify data. In environments where FreeIPA serves as the identity backbone, a sustained denial-of-service attack could disrupt authentication for all managed hosts and users, potentially causing broad operational impact (Red Hat CVE, Red Hat Bugzilla).

A proof-of-concept (PoC) exploit is noted as available per NVD SSVC data, though no public exploit code has been linked in available sources. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no in-the-wild exploitation has been reported. The EPSS score is 0.0, indicating a very low current probability of active exploitation. Exploitation is not fully automatable because it requires prior authentication as a non-anonymous LDAP user (Red Hat Bugzilla, GitHub Advisory).

1. Identify target: Locate a FreeIPA deployment running ipa-4.13.1-3.el10 with the ipa-enrollment SLAPI plugin enabled and the LDAP service accessible over the network.
2. Obtain credentials: Acquire any valid, non-anonymous LDAP account credentials within the FreeIPA domain (e.g., a standard user account).
3. Establish secure LDAP connection: Connect to the target LDAP server using StartTLS or LDAPS to ensure the connection Security Strength Factor (SSF) is greater than 1, as the plugin rejects connections below this threshold.
4. Authenticate: Perform an LDAP bind using the obtained non-anonymous credentials.
5. Send malformed extended operation: Transmit an LDAP extended operation request with OID 2.16.840.1.113730.3.8.10.3 (JOIN_OID) and deliberately omit the request value (BER value).
6. Trigger crash: The ipa_join() function dereferences extop_value->bv_val without a NULL check, causing a NULL pointer dereference that crashes the Directory Server process and denies service to all LDAP clients (Red Hat Bugzilla).

• Network: Repeated LDAP extended operation requests to OID 2.16.840.1.113730.3.8.10.3 (JOIN_OID) from a single authenticated source with no accompanying request value; unusual volume of LDAP extended operation traffic from non-enrollment clients.
• Logs: Directory Server error logs showing segmentation faults or NULL pointer dereference errors in ipa_enrollment.c; crash/core dump entries associated with the ns-slapd process; LDAP access logs recording JOIN_OID extended operations from unexpected source IPs.
• Process: Unexpected termination or restart of the ns-slapd (Directory Server) process; core dump files generated in the Directory Server working directory following LDAP extended operation requests (Red Hat Bugzilla, Red Hat CVE).

No released package fix is currently available for ipa-4.13.1-3.el10; a patch has been proposed but not yet shipped. Red Hat recommends two interim mitigations: (1) restrict network access to the LDAP service using firewall rules to allow connections only from trusted IP addresses or subnets, and (2) if host enrollment functionality is not required, disable the ipa-enrollment SLAPI plugin entirely to eliminate the attack surface. Organizations should monitor the Red Hat Bugzilla tracker (Bug 2471741) and Red Hat CVE page for patch availability and apply the fix as soon as a fixed package is released (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was discovered by AISLE Research in partnership with Red Hat and reported through Red Hat's coordinated disclosure process. The bug was filed under embargo on May 11, 2026, and publicly disclosed on August 20, 2026, with no embargo applied given the limited impact (authenticated DoS only, no confidentiality or integrity exposure). No significant public commentary, social media discussion, or media coverage has been identified beyond standard vulnerability database entries (Red Hat CVE, Red Hat Bugzilla).