FreeIPA PAC Validation Bypass Enables AD User Privilege Escalation

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-11861 represents a critical authentication bypass in FreeIPA's trust relationship with Active Directory, allowing AD users to impersonate clients during Kerberos Ticket Granting Service (TGS) requests. The vulnerability stems from FreeIPA services failing to validate Privilege Attribute Certificate (PAC) data, which is essential for verifying user identity and authorization in cross-realm trust scenarios. With a CVSS score of 9.6, this flaw affects organizations using FreeIPA as an identity management solution integrated with Active Directory, potentially exposing sensitive services including the FreeIPA portal, SMB servers, and LDAP directories. Any authenticated AD user can exploit this to escalate privileges within FreeIPA's domain, making this a severe threat to hybrid identity environments.

Casky's 224 matching security skills leverage Claude's extended reasoning to detect the attack patterns underlying TA0004 (Privilege Escalation) techniques. Practitioners would observe findings highlighting improper Kerberos PAC validation, suspicious TGS ticket requests with mismatched client names, and unauthorized service access from previously low-privileged AD accounts. The platform maps detection patterns to CWE-266 (Improper Privilege Management), identifying anomalous cross-realm authentication flows where PAC claims diverge from ticket contents. By correlating Kerberos event logs, authentication failures-turned-successes, and lateral movement from AD-sourced identities into FreeIPA services, Casky's AI-driven analysis surfaces the subtle indicators that distinguish legitimate cross-realm authentication from exploitation attempts, enabling security teams to close this critical gap before attackers establish persistence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11861.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-11861

Casky has 224 skills that investigate the attack patterns behind CVE-2026-11861. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn