CVE-2026-19550
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
- Affected products
- Freeipa, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Enterprise Linux
- Redhat Enterprise Linux
- = 7.0, 8.0, 9.0, 10.0
- CVSS 3.1
- 8.2 HIGH
- EPSS
- 0.2% (14th percentile)
- Weakness
- CWE-863
- NVD status
- Analyzed
- Published
- 2026-08-11
Workaround
This issue is fixed upstream. Administrators should apply this fix once available for their platform. Until then, the previously suggested compensating control (restricting "System: Read Trust Information" so it is not granted to all authenticated users) remains a valid interim workaround, with the same caveat that doing so may affect SSSD subdomain support, which relies on that permission's default breadth.
No indexed exploits for CVE-2026-19550 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-19550 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.