A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-server-encrypted-dnsUpgrade ipa-client-epnUpgrade python3-pyusbUpgrade ipa-server-dnsUpgrade ipa-healthcheck-coreUpgrade python3-qrcodeUpgrade ipa-python-compatUpgrade ipa-client-commonUpgrade softhsmUpgrade python3-qrcode-coreUpgrade python3-kdcproxyUpgrade python3-ipaclientUpgrade ipa-client-sambaUpgrade bind-dyndb-ldapUpgrade python3-custodiaUpgrade python3-ipatestsUpgrade python3-yubicoUpgrade python3-ipaserverUpgrade ipa-server-trust-adUpgrade ipa-client-encrypted-dnsUpgrade custodiaUpgrade slapi-nisUpgrade python3-ipalibUpgrade opendnssecUpgrade ipa-clientUpgrade softhsm-develUpgrade ipa-selinux-lunaUpgrade ipa-commonUpgrade ipa-selinuxUpgrade python3-jwcryptoUpgrade ipa-serverUpgrade ipa-selinux-nfastUpgrade ipa-healthcheckUpgrade ipa-server-common | Oct 6, 2025 | Oct 1, 2025 |
| Amazon Linux Ami 2 | — | Upgrade ipa-python-compatUpgrade 389-ds-base-snmpUpgrade ipa-server-commonUpgrade python2-ipalibUpgrade ipa-debuginfoUpgrade ipa-server-dnsUpgrade ipa-client-commonUpgrade ipa-clientUpgrade ipa-serverUpgrade python2-ipaserverUpgrade ipa-server-trust-adUpgrade 389-ds-baseUpgrade 389-ds-base-libsUpgrade python2-ipaclientUpgrade 389-ds-base-develUpgrade 389-ds-base-debuginfoUpgrade ipa-common | May 20, 2026 | May 20, 2026 |
| Oracle_linux | — | Upgrade ipa-healthcheck-coreUpgrade python3-ipaserverUpgrade python3-ipatestsUpgrade python2-ipaserverUpgrade ipa-client-encrypted-dnsUpgrade ipa-client-epnUpgrade slapi-nisUpgrade python2-ipaclientUpgrade ipa-selinux-lunaUpgrade ipa-healthcheckUpgrade ipa-commonUpgrade ipa-selinuxUpgrade ipa-client-commonUpgrade custodiaUpgrade python3-pyusbUpgrade ipa-server-commonUpgrade python3-yubicoUpgrade bind-dyndb-ldapUpgrade softhsm-develUpgrade python3-ipaclientUpgrade ipa-python-compatUpgrade python2-ipalibUpgrade ipa-server-encrypted-dnsUpgrade python3-kdcproxyUpgrade ipa-serverUpgrade python3-jwcryptoUpgrade ipa-server-trust-adUpgrade ipa-clientUpgrade softhsmUpgrade python3-custodiaUpgrade ipa-client-sambaUpgrade python3-qrcode-coreUpgrade python3-ipalibUpgrade opendnssecUpgrade ipa-server-dnsUpgrade ipa-selinux-nfastUpgrade python3-qrcode | Oct 2, 2025 | Sep 30, 2025 |
| Redhat_linux | — | Upgrade python3-ipalibUpgrade python2-ipaserverUpgrade ipa-selinux-nfastUpgrade softhsm-debuginfoUpgrade custodiaUpgrade ipa-clientUpgrade python2-ipaclientUpgrade ipa-healthcheck-coreUpgrade ipa-client-debuginfoUpgrade ipa-server-debuginfoUpgrade softhsm-develUpgrade ipa-server-trust-adUpgrade python3-kdcproxyUpgrade ipa-selinux-lunaUpgrade softhsm-debugsourceNo solution existsUpgrade opendnssec-debugsourceUpgrade ipa-debugsourceUpgrade python3-pyusbUpgrade ipa-serverUpgrade python3-qrcode-coreUpgrade slapi-nis-debugsourceUpgrade softhsmUpgrade opendnssec-debuginfoUpgrade ipa-client-commonUpgrade slapi-nis-debuginfoUpgrade slapi-nisUpgrade python3-yubicoUpgrade python3-custodiaUpgrade ipa-server-encrypted-dnsUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-client-encrypted-dnsUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade python3-ipatestsUpgrade ipa-selinuxUpgrade python3-ipaclientUpgrade python3-qrcodeUpgrade ipa-commonUpgrade bind-dyndb-ldapUpgrade python2-ipalibUpgrade opendnssecUpgrade ipa-server-dnsUpgrade ipa-healthcheckUpgrade python3-jwcryptoUpgrade ipa-python-compatUpgrade ipa-server-commonUpgrade ipa-client-sambaUpgrade ipa-client-epnUpgrade ipa-debuginfoUpgrade python3-ipaserver | Oct 1, 2025 | Sep 30, 2025 |
| Rocky_linux | — | Upgrade slapi-nisUpgrade ipa-client-debuginfoUpgrade bind-dyndb-ldapUpgrade softhsm-debugsourceUpgrade softhsm-develUpgrade ipa-debugsourceUpgrade opendnssec-debugsourceUpgrade softhsmUpgrade ipa-server-encrypted-dnsUpgrade opendnssecUpgrade slapi-nis-debugsourceUpgrade ipa-server-trust-adUpgrade opendnssec-debuginfoUpgrade ipa-debuginfoUpgrade ipa-server-debuginfoUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-client-encrypted-dnsUpgrade ipa-serverUpgrade slapi-nis-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-client-sambaUpgrade ipa-client-epnUpgrade ipa-clientUpgrade bind-dyndb-ldap-debuginfoUpgrade softhsm-debuginfo | Feb 5, 2026 | Nov 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub