CVE-2026-19550 — Vulnerability intelligence

redhat — enterprise linux

Published: 2026-08-11T20:46:42.019Z

CVSS

8.2

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

Sources

• CVE-2026-19550
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• Mitigation, Vendor Advisory
• Issue Tracking, Vendor Advisory
• CVE-2026-19550