Patched, modern Active Directory setups largely mitigate FreeIPA's cross-realm PAC impersonation flaw, FreeIPA says

A Kerberos service that never reads the PAC takes the ticket's client name at face value. That is CVE-2026-11861 in one line: FreeIPA application services did not verify PAC content, so a cross-realm TGS request carrying an impersonated cname was honoured by the Web UI and IPA API, by SMB services, and by the LDAP directory ^[1][2]. Authorization collapses into whatever the trusted realm asserts.

The prerequisite is where this one turns, and FreeIPA says it out loud. The impersonation technique depends on registering a duplicate or conflicting Service Principal Name in the Active Directory forest ^[3]. Microsoft enforced SPN and UPN uniqueness on Windows Server 2012 R2 domain controllers with MSKB-3070083 applied, and by default on Windows 11 version 22H2 and later ^[4]. Where the DCs are patched and the functional level is supported, the FreeIPA advisory says the path is blocked on the Windows side, that only deployments trusting an outdated or unpatched forest remain realistically at risk, and that this makes the flaw primarily a theoretical concern in maintained environments ^[5]. The release notes assign no CVSS scores and describe no exploitation ^[18].

CVE-2026-13097 has no such dependency. The uniqueness constraint that 389-ds enforces on Kerberos principal name attributes does not account for equivalent representations of the same name, so a user with sufficient LDAP write privileges can create a service principal that impersonates an existing privileged one ^[6], then collect Kerberos service tickets for sensitive services, up to full domain compromise ^[7]. Vladislav Plyatsok (rd01f) is credited with both escalation flaws ^[8]. Only one of the two needs anything at all from Active Directory ^[16].

Four of the seven entries are denial of service ^[14][15]. Two need no credentials: oversized form POSTs to /ipa/migration/migration.py, and arbitrarily large bodies to /ipa/i18n_messages, each read fully into memory ^[10][11]. One is a low-privilege authenticated CPU and memory burn, where an oversized OTP key submitted to otptoken-add is decoded and re-encoded without a size limit ^[9]. The fourth deserves more weight than its class suggests: a remote authenticated client that omits the request value for JOIN_OID in the ipa-enrollment extended operation triggers a NULL pointer dereference and crashes the server ^[12]. That is a directory server outage available to anyone holding a credential. The seventh entry, CVE-2026-19550, states that trust-fetch-domains, the command used to refresh Active Directory trust topology, is gated only by a read permission; the published description breaks off there ^[13].

For 11861, the variable that decides exposure sits in someone else's forest: which domain controllers, at which patch level, at which functional level. FreeIPA 4.13.3 removes the IPA side's dependence on that answer, and builds are on freeipa.org with Fedora packages to follow ^[17].