VDB

CVE-2026-19550

CVE-2026-19550 PUBLISHED CVSS 8.2 HIGH

Reported by redhat · Published August 11, 2026

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
ipa-selinuxerrata.rockylinux.org4.13.4-1.el9, 4.13.4-1.el10, 4.9.13-21.module
ipa-selinux-lunaerrata.rockylinux.org4.13.4-1.el9, 4.13.4-1.el10
slapi-nis-debuginfoerrata.rockylinux.org0.60.0-4.module
python3-ipaliberrata.rockylinux.org4.13.4-1.el9, 4.13.4-1.el10, 4.9.13-21.module
ipa-client-sambaerrata.rockylinux.org4.13.4-1.el9, 4.13.4-1.el10
python3-ipatestserrata.rockylinux.org4.13.4-1.el9, 4.13.4-1.el10, 4.9.13-21.module
ipa-server-debuginfoerrata.rockylinux.org4.13.4-1.el9, 4.13.4-1.el10
ipa-server-dnserrata.rockylinux.org4.13.4-1.el9, 4.13.4-1.el10
ipa-server-trust-ad-debuginfoerrata.rockylinux.org4.13.4-1.el9, 4.13.4-1.el10, 4.9.13-21.module
ipaerrata.rockylinux.org4.13.4-1.el9, 4.13.4-1.el10
ipa-selinux-nfasterrata.rockylinux.org4.13.4-1.el9, 4.13.4-1.el10
ipa-client-commonerrata.rockylinux.org4.13.4-1.el9, 4.13.4-1.el10, 4.9.13-21.module

31 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
8.2
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected products

VendorProductVersions
Red HatRed Hat Enterprise Linux 100:4.13.4-1.el10_2
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support0:4.12.2-15.el10_0.7
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support0:4.6.8-5.el7_9.25
Red HatRed Hat Enterprise Linux 88100020261007071200.143e9e98
Red HatRed Hat Enterprise Linux 88100020261007070536.823393f5
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support8040020261027121250.f153676a
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support8040020261027121355.5b01ab7e
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On8040020261027121250.f153676a
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On8040020261027121355.5b01ab7e
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support8060020261008134123.c1533a64
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support8060020261008133528.ada582f1
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On8060020261008134123.c1533a64
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On8060020261008133528.ada582f1
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service8080020261007080925.e581a9e4
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service8080020261007071832.b0a6ceea
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions8080020261007080925.e581a9e4
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions8080020261007071832.b0a6ceea
Red HatRed Hat Enterprise Linux 90:4.13.4-1.el9_8
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions0:4.10.1-12.el9_2.7
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions0:4.11.0-15.el9_4.9

…and 38 more

Timeline

  • Aug 11, 2026 CVE Published
  • Aug 12, 2026 Coalition ESS Score
  • Aug 14, 2026 Security Advisory (13 in total, the first dated here)
  • Aug 20, 2026 EPSS Score (25 in total, the first dated here)
  • Sep 24, 2026 Distribution Patch (14 in total, the first dated here)
  • Nov 2, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-19550
vulnetix vdb fixes CVE-2026-19550

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-19550/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›