Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-13097
Red Hat Red Hat Enterprise Linux 10 — Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L H N C H H N 8.7 .0043 34.7 —
AFFECTED
Product Versions Fixed
Red Hat Enterprise Linux 10 unspecified 0:4.13.4-1.el10_2
Red Hat Enterprise Linux 9 unspecified 0:4.13.4-1.el9_8
Red Hat Enterprise Linux 6 unspecified —
Red Hat Enterprise Linux 7 unspecified —
Red Hat Enterprise Linux 8 unspecified —
Red Hat Enterprise Linux 8 unspecified —
Red Hat Enterprise Linux 8 unspecified —
TIMELINE
Jun 23 Reserved by redhat
Aug 20 Published (CNA: redhat)
Aug 27 RESCORED — CVE-2026-13097 (Red Hat Enterprise Linux 10). CVSS 9.1 → 8.7 (NVD).
Sep 23 PATCH SHIPPED — CVE-2026-13097 (Red Hat Enterprise Linux 9). Fixed in Red Hat Enterprise Linux 9 0:4.13.4-1.el9_8.
Description
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| June 23, 2026 | Reserved | Reserved by redhat |
| August 20, 2026 | Published | Published (CNA: redhat) |
| August 27, 2026 | RESCORED | RESCORED — CVE-2026-13097 (Red Hat Enterprise Linux 10). CVSS 9.1 → 8.7 (NVD). |
| September 23, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-13097 (Red Hat Enterprise Linux 9). Fixed in Red Hat Enterprise Linux 9 0:4.13.4-1.el9_8. |
Affected
Affected products and packages — 7 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — | 0:4.13.4-1.el10_2 |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | 0:4.13.4-1.el9_8 |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-13097 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
