https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T10:13:08.564286+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/alsa-2026:70564 ALSA-2026:70564 — Critical: ipa security, bug fix, and enhancement update 2026-09-28T10:13:08.603534+00:00

Affected: AlmaLinux:9: ipa-client, AlmaLinux:9: ipa-client-common, AlmaLinux:9: ipa-client-encrypted-dns, AlmaLinux:9: ipa-client-epn, AlmaLinux:9: ipa-client-samba, AlmaLinux:9: ipa-common, AlmaLinux:9: ipa-selinux, AlmaLinux:9: ipa-selinux-luna, AlmaLinux:9: ipa-selinux-nfast, AlmaLinux:9: ipa-server and 8 more

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)

Bug Fix(es) and Enhancement(s):

* [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux9.8] (JIRA:AlmaLinux-170987) * WebUI Hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238511) * ipa-otpt…

 https://db.gcve.eu/vuln/fkie_cve-2026-79678 fkie_cve-2026-79678 2026-09-28T10:13:08.603680+00:00

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

 https://db.gcve.eu/vuln/ghsa-2rwh-2wx9-4qwh GHSA-2rwh-2wx9-4qwh 2026-09-28T10:13:08.603729+00:00

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

 https://db.gcve.eu/vuln/rhsa-2026:70564 RHSA-2026:70564 — Red Hat Security Advisory: ipa security, bug fix, and enhancement update 2026-09-28T10:13:08.603756+00:00

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

 https://db.gcve.eu/vuln/ubuntu-cve-2026-79678 UBUNTU-CVE-2026-79678 2026-09-28T10:13:08.603805+00:00

Affected: Ubuntu:Pro:14.04:LTS: freeipa, Ubuntu:Pro:16.04:LTS: freeipa, Ubuntu:18.04:LTS: freeipa, Ubuntu:20.04:LTS: freeipa, Ubuntu:22.04:LTS: freeipa, Ubuntu:24.04:LTS: freeipa, Ubuntu:26.04:LTS: freeipa

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.