security_identifier

CVE-2026-11861

Identifier for a FreeIPA flaw in which application services do not verify Privilege Attribute Certificate content, allowing client-name impersonation in the Ticket Granting Service across a FreeIPA to Active Directory trust.

Current clusters

security1 publisher

Patched, modern Active Directory setups largely mitigate FreeIPA's cross-realm PAC impersonation flaw, FreeIPA says

FreeIPA 4.13.3 lists seven security issues. The one that sets upgrade order needs no Active Directory at all, just LDAP write privileges inside the IPA domain, which is enough to impersonate a privileged service principal.

Publishers:freeipa.org

Reality

Evidence64
Adoption18
Hype gap−12
Incentives60
Confidence66