Description
A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the `JOIN_OID` in the `ipa-enrollment` extended operation, an attacker can trigger a server crash, potentially causing a denial of service.
Published: 2026-08-20
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A null pointer dereference exists in the ipa-enrollment SLAPI plugin, which is triggered by an LDAP extended operation missing the JOIN_OID request value. The flaw causes the IAS server to crash, leading to a denial of service for clients relying on the service. The vulnerability maps to CWE‑476 – Dereference of a Null Pointer, bringing impact primarily to availability rather than confidentiality or integrity.

Affected Systems

Red Hat Enterprise Linux 6, 7, 8, 9, and 10 running the FreeIPA appliance that includes the ipa-enrollment plugin.

Risk and Exploitability

The CVSS score of 6.5 classifies the flaw as medium severity. Attackers must be authenticated to the LDAP service to send the malformed extended operation, which limits the attack scope to users with valid access. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Given the need for authentication, the likelihood of widespread exploitation is moderate, but a successful exploit results in an immediate denial of service to affected LDAP clients.

Generated by OpenCVE AI on August 20, 2026 at 22:09 UTC.

Remediation

Vendor Workaround

Restrict network access to the LDAP service to trusted clients only. This can be achieved by configuring firewall rules to allow connections only from known, trusted IP addresses or subnets, thereby limiting the ability of authenticated attackers to send malformed extended operations. If host enrollment functionality is not required, disabling the `ipa-enrollment` SLAPI plugin can remove this attack surface.

OpenCVE Recommended Actions

  • Apply any vendor patch or update that fixes the null pointer dereference in ipa-enrollment.
  • If no patch exists, permanently disable the ipa-enrollment SLAPI plugin to remove the vulnerable extended operation from the server.
  • Configure firewall rules to allow LDAP connections only from trusted IP addresses or networks, thereby limiting the authenticated attack surface.

Generated by OpenCVE AI on August 20, 2026 at 22:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 20 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 11:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the `JOIN_OID` in the `ipa-enrollment` extended operation, an attacker can trigger a server crash, potentially causing a denial of service.
Title Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-476
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Enterprise Linux
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-20T13:50:10.301Z

Reserved: 2026-08-11T12:49:53.471Z

Link: CVE-2026-73199

cve-icon Vulnrichment

Updated: 2026-08-20T13:49:44.282Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-20T11:16:21.813

Modified: 2026-08-20T14:17:58.773

Link: CVE-2026-73199

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-20T10:16:36Z

Links: CVE-2026-73199 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T22:15:04Z

Weaknesses