DEBIAN-CVE-2026-79678

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-79678

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-79678.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-79678

Upstream

CVE-2026-79678

Published

2026-09-07T13:20:38Z

Modified

2026-09-09T08:47:25Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVSS Calculator

Summary

[none]

Details

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.

References

https://security-tracker.debian.org/tracker/CVE-2026-79678

Affected packages

Debian:12 / freeipa

Package

Name: freeipa
Purl: pkg:deb/debian/freeipa?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.9.11-1

4.9.11-1+exp1

4.9.11-2

4.10.1-1+exp1

4.10.1+dfsg1-1+exp1

4.10.2-1

4.10.2-2

4.10.2-2+exp1

4.11.1-1

4.11.1-1+exp1

4.11.1-2

4.11.1-2+exp1

4.11.1-2.1

4.12.2-1

4.12.2-2

4.12.2-3

4.12.4-1

4.12.4-2

4.13.1-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-79678.json"

Debian:13 / freeipa