live wire
▸PLATFORM · Quay.io push and pull operations hit intermittent 500 errors during maintenanceRed Hat status▸INTEGRATION · Apache Camel exposes incident and web search as parallel tools for a local agentApache Camel▸AI · Red Hat makes confidential GPU AI GA and previews VM-isolated Agent Sandbox (Aug. 4)Red Hat Blog▸SECURITY · Red Hat fixes Important MariaDB GIS memory-corruption flaw in Hardened ImagesRed Hat Product Security▸SECURITY · Red Hat restores CVE pages after a CWE dependency outage; monitoring continuesRed Hat status▸PLATFORM · Red Hat implements a fix for docs.redhat.com degradation and begins monitoringRed Hat status▸AI · vLLM combines PCP, DCP and host-memory offload to serve 1M-token GLM-5.3 contextsvLLM▸AI · vLLM ships day-zero MiniMax-M3.1-Flash support across NVIDIA and AMD GPUsvLLM▸SECURITY · Red Hat revokes compromised eMudhra certificates across RHEL and OpenShift trust storesRed Hat Product Security▸SECURITY · Red Hat rates PHP2Shell request-handling flaws Important; fixes are rolling outRed Hat Product Security▸AI · IBM maps GPU observability and FinOps controls across OpenShift clustersIBM Community▸IDENTITY · Red Hat shows Data Grid authentication through Keycloak 26 on OpenShiftRed Hat Developer▸AI · Red Hat layers tenant isolation, tool authorization and rate limits onto MCP gatewaysRed Hat Developer▸DATA · Red Hat maps direct LDAP and LDAPS authentication for Data Grid on OpenShiftRed Hat Developer▸PLATFORM · Quay.io push and pull operations hit intermittent 500 errors during maintenanceRed Hat status▸INTEGRATION · Apache Camel exposes incident and web search as parallel tools for a local agentApache Camel▸AI · Red Hat makes confidential GPU AI GA and previews VM-isolated Agent Sandbox (Aug. 4)Red Hat Blog▸SECURITY · Red Hat fixes Important MariaDB GIS memory-corruption flaw in Hardened ImagesRed Hat Product Security▸SECURITY · Red Hat restores CVE pages after a CWE dependency outage; monitoring continuesRed Hat status▸PLATFORM · Red Hat implements a fix for docs.redhat.com degradation and begins monitoringRed Hat status▸AI · vLLM combines PCP, DCP and host-memory offload to serve 1M-token GLM-5.3 contextsvLLM▸AI · vLLM ships day-zero MiniMax-M3.1-Flash support across NVIDIA and AMD GPUsvLLM▸SECURITY · Red Hat revokes compromised eMudhra certificates across RHEL and OpenShift trust storesRed Hat Product Security▸SECURITY · Red Hat rates PHP2Shell request-handling flaws Important; fixes are rolling outRed Hat Product Security▸AI · IBM maps GPU observability and FinOps controls across OpenShift clustersIBM Community▸IDENTITY · Red Hat shows Data Grid authentication through Keycloak 26 on OpenShiftRed Hat Developer▸AI · Red Hat layers tenant isolation, tool authorization and rate limits onto MCP gatewaysRed Hat Developer▸DATA · Red Hat maps direct LDAP and LDAPS authentication for Data Grid on OpenShiftRed Hat Developer
upstreambeat.ai
releaseIDENTITY

Critical Red Hat IdM update closes credential exposure and privilege-escalation paths

RHSA-2026:70564 updates RHEL 9’s IPA packages for eight FreeIPA vulnerabilities, including an unauthenticated route to administrator credentials.

Critical Red Hat IdM update fixing eight FreeIPA flaws
AI-generated illustration
By The Release Desk· Sep 24, 2026the quick take — two AI hosts go live when you do

Red Hat has issued a Critical security update for the IPA packages that provide Red Hat Identity Management on Red Hat Enterprise Linux 9. RHSA-2026:70564 addresses eight FreeIPA vulnerabilities; Red Hat’s affected-products list includes RHEL 9 and RHEL 9.8 Extended Update Support across x86_64, Arm, IBM Power and IBM Z.

What changed

The advisory’s highest-consequence entries include an unauthenticated LDAP path that can expose administrator credentials, a Kerberos trust flaw that can obtain a ticket-granting service ticket with an impersonated client name, and two separate privilege-escalation or unauthorized-write paths. It also fixes two unauthenticated denial-of-service issues, a crafted-URL cross-site scripting flaw, and an authorization-order issue that can expose environment data or cause denial of service.

The fixed IPA build is 4.13.4-1.el9_8 for the RHEL 9.8 channels listed by Red Hat. The advisory also includes Web UI, token-import and migration hardening changes.

Who is affected

Administrators running Red Hat Identity Management on the affected RHEL 9 channels should treat this as a priority patch. The advisory covers IdM server and client packages, with several issues affecting trust relationships, LDAP authorization controls, migration endpoints or administrative credentials.

What to do

Apply the updated IPA packages through the normal RHEL update process and follow Red Hat’s remediation guidance in the advisory. Because the update changes authentication and identity-management components, operators should use their established change window and validate IdM authentication, Kerberos trust, replication and Web UI access after the update.

sources

Filed by The Release Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk