Status: UPDATED
| Advisory ID: CVE-2026-79678
Key Details
| CVE | CVE-2026-79678 |
| CVSS Score / Version | 8.1 (High) / CVSS v3.1 |
| Updated | 2026-09-29 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is none; availability impact is high. |
| Affected products | Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, and Red Hat Enterprise Linux 9 |
| Classified as | CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')) |
Affected Products, Subsystems & Sectors
| Subsystems | OT Supporting Infrastructure |
| Sectors | Multiple |
What to Know
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.
References