A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-server-trust-adUpgrade ipa-selinux-nfastUpgrade ipa-server-dnsUpgrade ipa-healthcheck-coreUpgrade python3-kdcproxyUpgrade custodiaUpgrade python3-custodiaUpgrade python3-ipalibUpgrade ipa-python-compatUpgrade slapi-nisUpgrade softhsm-develUpgrade ipa-server-commonUpgrade ipa-server-encrypted-dnsUpgrade python3-pyusbUpgrade opendnssecUpgrade python3-qrcodeUpgrade ipa-client-commonUpgrade softhsmUpgrade python3-qrcode-coreUpgrade python3-yubicoUpgrade ipa-client-sambaUpgrade ipa-selinux-lunaUpgrade ipa-clientUpgrade python3-ipaserverUpgrade python3-ipatestsUpgrade ipa-commonUpgrade ipa-client-encrypted-dnsUpgrade bind-dyndb-ldapUpgrade ipa-client-epnUpgrade python3-ipaclientUpgrade ipa-serverUpgrade ipa-healthcheckUpgrade python3-jwcryptoUpgrade ipa-selinux | Oct 11, 2026 | Sep 23, 2026 |
| Amazon Linux Ami 2 | — | Upgrade ipa-python-compatUpgrade ipa-server-trust-adUpgrade ipa-serverUpgrade python2-ipalibUpgrade ipa-clientUpgrade ipa-debuginfoUpgrade python2-ipaclientUpgrade ipa-server-dnsUpgrade ipa-client-commonUpgrade ipa-commonUpgrade ipa-server-commonUpgrade python2-ipaserver | Oct 19, 2026 | Oct 19, 2026 |
| Freebsd | — | Upgrade freeipa-server | Sep 18, 2026 | Sep 11, 2026 |
| Oracle_linux | — | Upgrade python3-ipalibUpgrade ipa-server-encrypted-dnsUpgrade python3-ipatestsUpgrade ipa-selinux-nfastUpgrade slapi-nisUpgrade softhsmUpgrade ipa-client-encrypted-dnsUpgrade ipa-clientUpgrade python3-pyusbUpgrade ipa-server-commonUpgrade ipa-healthcheck-coreUpgrade python3-kdcproxyUpgrade python3-yubicoUpgrade python3-qrcode-coreUpgrade custodiaUpgrade opendnssecUpgrade ipa-server-trust-adUpgrade ipa-client-commonUpgrade ipa-serverUpgrade ipa-python-compatUpgrade ipa-healthcheckUpgrade ipa-client-epnUpgrade python3-jwcryptoUpgrade ipa-client-sambaUpgrade python3-ipaserverUpgrade ipa-selinux-lunaUpgrade python3-qrcodeUpgrade python3-ipaclientUpgrade python3-custodiaUpgrade bind-dyndb-ldapUpgrade softhsm-develUpgrade ipa-commonUpgrade ipa-selinuxUpgrade ipa-server-dns | Oct 22, 2026 | Aug 20, 2026 |
| Redhat_linux | — | Upgrade python3-custodiaUpgrade ipa-commonNo solution existsUpgrade ipa-debuginfoUpgrade slapi-nisUpgrade opendnssec-debuginfoUpgrade python3-ipaserverUpgrade python3-pyusbUpgrade ipa-debugsourceUpgrade ipa-clientUpgrade ipa-serverUpgrade python3-qrcode-coreUpgrade ipa-server-encrypted-dnsUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade bind-dyndb-ldap-debuginfoUpgrade softhsmUpgrade python3-yubicoUpgrade ipa-server-trust-adUpgrade opendnssecUpgrade softhsm-develUpgrade slapi-nis-debugsourceUpgrade ipa-selinux-nfastUpgrade ipa-python-compatUpgrade ipa-client-commonUpgrade ipa-server-debuginfoUpgrade ipa-selinux-lunaUpgrade ipa-client-encrypted-dnsUpgrade softhsm-debugsourceUpgrade opendnssec-debugsourceUpgrade ipa-server-trust-ad-debuginfoUpgrade bind-dyndb-ldapUpgrade python3-qrcodeUpgrade slapi-nis-debuginfoUpgrade python3-jwcryptoUpgrade ipa-server-commonUpgrade ipa-healthcheck-coreUpgrade ipa-client-debuginfoUpgrade ipa-selinuxUpgrade softhsm-debuginfoUpgrade python3-kdcproxyUpgrade ipa-client-sambaUpgrade python3-ipatestsUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-healthcheckUpgrade python3-ipaclientUpgrade python3-ipalibUpgrade custodia | Aug 24, 2026 | Aug 20, 2026 |
| Rocky_linux | — | Upgrade bind-dyndb-ldap-debugsourceUpgrade slapi-nisUpgrade slapi-nis-debuginfoUpgrade ipa-client-epnUpgrade opendnssec-debuginfoUpgrade ipa-server-debuginfoUpgrade slapi-nis-debugsourceUpgrade ipa-server-trust-adUpgrade softhsm-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-debugsourceUpgrade opendnssec-debugsourceUpgrade bind-dyndb-ldapUpgrade softhsm-develUpgrade softhsm-debugsourceUpgrade ipa-serverUpgrade ipa-client-encrypted-dnsUpgrade ipa-clientUpgrade softhsmUpgrade ipa-debuginfoUpgrade opendnssecUpgrade ipa-server-encrypted-dnsUpgrade ipa-client-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-client-samba | Sep 28, 2026 | Sep 24, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub