RLSA-2026:83460
Critical: idm:DL1 security, bug fix, and enhancement update
Published Oct 15, 2026 · updated Oct 15, 2026
Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * Fix ipatests for kdcproxy after CVE-2025-59088 fix [rhel-8.10.z] (JIRA:Rocky Linux-129966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · OSV.dev
Detected
Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in via Unbounded Request Body Read (CVE-2026-73197)
Oct 15, 2026 · OSV.dev
Fix available
bind-dyndb-ldap fixed in 0:11.6-6.module+el8.10.0+1960+1ed527b3; custodia fixed in 0:0.6.0-3.module+el8.9.0+1371+ffa84eb9; ipa fixed in 0:4.9.13-21.module+el8.10.0+40089+03bf3c1f; ipa fixed in 0:4.9.13-21.module+el8.10.0+40090+e6f37a74
Oct 15, 2026 · OSV.dev
Fix available
bind-dyndb-ldap fixed in 0:11.6-6.module+el8.10.0+1960+1ed527b3
Oct 15, 2026 · OSV.dev
Fix available
custodia fixed in 0:0.6.0-3.module+el8.9.0+1371+ffa84eb9
Oct 15, 2026 · OSV.dev
Fix available
ipa fixed in 0:4.9.13-21.module+el8.10.0+40089+03bf3c1f
Oct 15, 2026 · OSV.dev
Fix available
ipa fixed in 0:4.9.13-21.module+el8.10.0+40090+e6f37a74
Oct 15, 2026 · OSV.dev
Fix available
ipa-healthcheck fixed in 0:0.12-6.module+el8.10.0+2053+a0a9dc19
Oct 15, 2026 · OSV.dev
Fix available
ipa-healthcheck fixed in 0:0.12-6.module+el8.10.0+2054+aa003774
Oct 15, 2026 · OSV.dev
Fix available
opendnssec fixed in 0:2.1.7-2.module+el8.10.0+1960+1ed527b3
Oct 15, 2026 · OSV.dev
Fix available
python-jwcrypto fixed in 0:0.5.0-2.module+el8.10.0+1818+2dfda7a6
Oct 15, 2026 · OSV.dev
Fix available
python-jwcrypto fixed in 0:0.5.0-2.module+el8.10.0+1819+0aeba2f1
Oct 15, 2026 · OSV.dev
Fix available
python-kdcproxy fixed in 0:0.4-5.module+el8.9.0+1371+ffa84eb9
Oct 15, 2026 · OSV.dev
Fix available
python-kdcproxy fixed in 0:0.4-5.module+el8.10.0+1915+3c70f7d9.1
Oct 15, 2026 · OSV.dev
Fix available
python-kdcproxy fixed in 0:0.4-5.module+el8.10.0+2094+d7886766.2
Oct 15, 2026 · OSV.dev
Updated
Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in via Unbounded Request Body Read (CVE-2026-73197)
Affected
- Rocky Linux:8 bind-dyndb-ldap0 → 0:11.6-6.module+el8.10.0+1960+1ed527b3
- Rocky Linux:8 custodia0 → 0:0.6.0-3.module+el8.9.0+1371+ffa84eb9
- Rocky Linux:8 ipa0 → 0:4.9.13-21.module+el8.10.0+40089+03bf3c1f
- Rocky Linux:8 ipa0 → 0:4.9.13-21.module+el8.10.0+40090+e6f37a74
- Rocky Linux:8 ipa-healthcheck0 → 0:0.12-6.module+el8.10.0+2053+a0a9dc19
- Rocky Linux:8 ipa-healthcheck0 → 0:0.12-6.module+el8.10.0+2054+aa003774
- Rocky Linux:8 opendnssec0 → 0:2.1.7-2.module+el8.10.0+1960+1ed527b3
- Rocky Linux:8 python-jwcrypto0 → 0:0.5.0-2.module+el8.10.0+1818+2dfda7a6
- Rocky Linux:8 python-jwcrypto0 → 0:0.5.0-2.module+el8.10.0+1819+0aeba2f1
- Rocky Linux:8 python-kdcproxy0 → 0:0.4-5.module+el8.10.0+1915+3c70f7d9.1
- Rocky Linux:8 python-kdcproxy0 → 0:0.4-5.module+el8.10.0+2094+d7886766.2
- Rocky Linux:8 python-kdcproxy0 → 0:0.4-5.module+el8.9.0+1371+ffa84eb9