CVE-2026-13097

Published: Ago 20, 2026 Last Modified: Ago 20, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

706

Use of Incorrectly-Resolved Name or Reference

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity
Potential Impacts:
Read Application Data Modify Application Data
Applicable Platforms
All platforms may be affected
View CWE Details
https://access.redhat.com/security/cve/CVE-2026-13097
https://access.redhat.com/security/cve/CVE-2026-13097
https://bugzilla.redhat.com/show_bug.cgi?id=2515974
https://bugzilla.redhat.com/show_bug.cgi?id=2515974