CVE-2026-67567 (CVSS 9.9): Red Hat Flaws Enable Privilege Escalation in ACM and FreeIPA

TL;DR

Red Hat disclosed three high-severity flaws that enable privilege escalation. The worst, CVE-2026-67567 (CVSS 9.9), hits Advanced Cluster Management for Kubernetes. Two FreeIPA bugs, CVE-2026-13097 and CVE-2026-11861, can reach full domain compromise. No exploitation in the wild or public proof-of-concept has been confirmed.

Why These Privilege Escalation Flaws Matter

Each flaw lets a low-trust user gain far more power. Two target FreeIPA, a common Linux identity system. One targets Red Hat ACM, a Kubernetes fleet manager. As a result, both identity and cluster boundaries are at risk. All three carry critical or near-critical scores.

How the Attacks Work

CVE-2026-67567: HelmRelease Controller Abuse

This ACM flaw scores a 9.9. The HelmRelease controller processes chart templates with its own elevated ServiceAccount. However, it skips proper validation. Therefore a tenant who can create HelmRelease resources can deploy across the whole cluster. The Red Hat advisory details this privilege escalation path.

CVE-2026-13097: Duplicate Kerberos Principals

FreeIPA enforces uniqueness on Kerberos principal names. However, it misses equivalent forms of the same name. So a user with LDAP write access can create a service principal that mimics a privileged one. That trick can yield tickets for sensitive services. Red Hat documents it in the CVE-2026-13097 advisory.

CVE-2026-11861: Trust-Based Auth Bypass

This flaw needs a FreeIPA and Active Directory trust. FreeIPA services fail to verify PAC certificates. Consequently, an AD user can impersonate a client in the TGS. Red Hat rates it Moderate in practice, as the CVE-2026-11861 advisory explains. Patched AD domain controllers block the attack path.

Affected Products

The flaws affect FreeIPA and Red Hat Advanced Cluster Management for Kubernetes. Deployments trusting outdated Active Directory face the highest CVE-2026-11861 risk.

Patch and Mitigation Steps

Apply Red Hat updates as they ship for each product. For the ACM flaw, restrict who can create HelmRelease resources. Use strict RBAC to limit those permissions. For the trust bypass, keep Active Directory domain controllers patched and current.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.