CVE-2026-18147

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

HIGH 8.1

At a glance

Source: NVD
EPSS: EPSS 0.53 % · percentile 45 (2026-10-28)
State: PUBLISHED
Published: 2026-09-09 16:39 UTC
Updated: 2026-10-26 13:26 UTC
Assigner: redhat
NVD status: Awaiting Analysis

Description

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.

Weaknesses (CWE)

CWE-79 — Cross-site Scripting (XSS)

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	redhat
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	NVD · secalert@redhat.com (Secondary)

European references

ENISA EUVD · EUVD-2026-75108
GCVE · GCVE-0-2026-18147

Affected products

Product	Versions
Red Hat · Red Hat Enterprise Linux 10	unaffected 0:4.13.4-1.el10_2 < *
Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support	unaffected 0:4.12.2-15.el10_0.7 < *
Red Hat · Red Hat Enterprise Linux 8	unaffected 8100020261007071200.143e9e98 < *
Red Hat · Red Hat Enterprise Linux 8	unaffected 8100020261007070536.823393f5 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	unaffected 8060020261008134123.c1533a64 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	unaffected 8060020261008133528.ada582f1 < *
Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	unaffected 8060020261008134123.c1533a64 < *
Red Hat · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	unaffected 8060020261008133528.ada582f1 < *
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service	unaffected 8080020261007080925.e581a9e4 < *
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service	unaffected 8080020261007071832.b0a6ceea < *
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	unaffected 8080020261007080925.e581a9e4 < *
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	unaffected 8080020261007071832.b0a6ceea < *
Red Hat · Red Hat Enterprise Linux 9	unaffected 0:4.13.4-1.el9_8 < *
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	unaffected 0:4.10.1-12.el9_2.7 < *
Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	unaffected 0:4.11.0-15.el9_4.9 < *
Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support	unaffected 0:4.12.2-14.el9_6.8 < *
Red Hat · Red Hat Enterprise Linux 6
Red Hat · Red Hat Enterprise Linux 7

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD