{"id":"CLSA-2026-1791364402","summary":"ipa: Fix of 8 CVEs","details":"- CVE-2026-76578: constrain the self-managed OTP token ACI, deny anonymous\n  modifications and harden self-service and delegated-write ACIs\n- CVE-2026-79678: enforce managed permissions before LDAP-oriented commands\n  run their callbacks, and require privileges for RA-agent backed operations\n- CVE-2026-13097: enforce Kerberos principal name uniqueness with a\n  principal-aware matching rule (new ipa-krbprinc-mr 389-ds plugin)\n- CVE-2026-11861: validate the PAC of cross-realm trust tickets in the KDB\n  driver, including ID override checks\n- CVE-2026-73198: limit the request body size of the unauthenticated\n  /ipa/i18n_messages endpoint\n- CVE-2026-73197: reject oversized Content-Length in the unauthenticated\n  password migration endpoint\n- CVE-2026-19550: require write access to the trust entry for\n  trust-fetch-domains\n- CVE-2026-18147: remove the redirect from the Web UI password reset page","modified":"2026-10-26T09:43:36.193228848Z","published":"2026-10-07T11:56:00Z","upstream":["CVE-2026-11861","CVE-2026-13097","CVE-2026-18147","CVE-2026-19550","CVE-2026-73197","CVE-2026-73198","CVE-2026-76578","CVE-2026-79678"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791364402.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11861"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13097"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18147"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19550"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73197"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73198"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76578"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79678"}],"affected":[{"package":{"name":"ipa-client","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-client?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-client-common","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-client-common?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-client-encrypted-dns","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-client-encrypted-dns?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-client-epn","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-client-epn?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-client-samba","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-client-samba?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-common","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-common?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-python-compat","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-python-compat?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-selinux","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-selinux?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-selinux-luna","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-selinux-luna?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-selinux-nfast","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-selinux-nfast?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-server","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-server?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-server-common","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-server-common?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-server-dns","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-server-dns?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-server-encrypted-dns","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-server-encrypted-dns?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"ipa-server-trust-ad","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/ipa-server-trust-ad?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"python3-ipaclient","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/python3-ipaclient?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"python3-ipalib","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/python3-ipalib?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"python3-ipaserver","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/python3-ipaserver?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}},{"package":{"name":"python3-ipatests","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/python3-ipatests?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-14.0.1.el9_6.5.tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1791364402.json"}}],"schema_version":"1.9.0"}