If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the "use_dns" setting is explicitly set to false are not affected.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-server-trust-adUpgrade python3-ipatestsUpgrade ipa-client-epnUpgrade python3-kdcproxyUpgrade ipa-healthcheckUpgrade ipa-server-dnsUpgrade ipa-healthcheck-coreUpgrade python3-custodiaUpgrade slapi-nisUpgrade python3-yubicoUpgrade ipa-serverUpgrade ipa-selinuxUpgrade python3-qrcodeUpgrade ipa-commonUpgrade ipa-python-compatUpgrade python3-jwcryptoUpgrade softhsm-develUpgrade python3-pyusbUpgrade python3-qrcode-coreUpgrade ipa-client-sambaUpgrade ipa-clientUpgrade softhsmUpgrade python3-ipaserverUpgrade ipa-server-commonUpgrade opendnssecUpgrade bind-dyndb-ldapUpgrade python3-ipalibUpgrade python3-ipaclientUpgrade ipa-client-commonUpgrade custodia | Nov 20, 2025 | Nov 12, 2025 |
| Amazon Linux Ami 2 | — | Upgrade python-kdcproxy | May 20, 2026 | May 20, 2026 |
| Oracle_linux | — | Upgrade custodiaUpgrade opendnssecUpgrade ipa-serverUpgrade ipa-python-compatUpgrade ipa-clientUpgrade softhsm-develUpgrade ipa-healthcheckUpgrade ipa-server-trust-adUpgrade ipa-commonUpgrade python3-jwcryptoUpgrade python3-ipalibUpgrade slapi-nisUpgrade python3-ipatestsUpgrade ipa-selinuxUpgrade python3-yubicoUpgrade python-kdcproxyUpgrade python3-ipaserverUpgrade python3-custodiaUpgrade python3-kdcproxyUpgrade python3-qrcode-coreUpgrade ipa-server-dnsUpgrade ipa-healthcheck-coreUpgrade python3-pyusbUpgrade ipa-server-commonUpgrade ipa-client-sambaUpgrade softhsmUpgrade python3-ipaclientUpgrade python3-qrcodeUpgrade ipa-client-commonUpgrade ipa-client-epnUpgrade bind-dyndb-ldap | Nov 17, 2025 | Nov 12, 2025 |
| Redhat_linux | — | Upgrade softhsm-debuginfoUpgrade custodiaUpgrade ipa-server-commonUpgrade softhsm-debugsourceUpgrade python3-pyusbUpgrade ipa-client-commonUpgrade ipa-server-debuginfoUpgrade bind-dyndb-ldapUpgrade ipa-debugsourceUpgrade python3-ipalibUpgrade slapi-nis-debuginfoUpgrade ipa-healthcheckUpgrade python3-ipatestsUpgrade opendnssec-debugsourceUpgrade ipa-client-debuginfoUpgrade ipa-server-trust-adUpgrade ipa-commonUpgrade bind-dyndb-ldap-debugsourceUpgrade python3-kdcproxyUpgrade ipa-server-trust-ad-debuginfoUpgrade python3-yubicoUpgrade ipa-selinuxUpgrade ipa-python-compatUpgrade ipa-client-sambaUpgrade ipa-server-dnsUpgrade python-kdcproxyUpgrade opendnssecUpgrade python3-jwcryptoUpgrade softhsmUpgrade ipa-debuginfoUpgrade softhsm-develUpgrade slapi-nisUpgrade opendnssec-debuginfoUpgrade python3-ipaserverUpgrade python3-ipaclientUpgrade ipa-healthcheck-coreUpgrade ipa-clientUpgrade ipa-client-epnUpgrade bind-dyndb-ldap-debuginfoUpgrade slapi-nis-debugsourceUpgrade python3-custodiaUpgrade ipa-serverUpgrade python3-qrcodeUpgrade python3-qrcode-core | Nov 14, 2025 | Nov 12, 2025 |
| Rocky_linux | — | Upgrade ipa-server-debuginfoUpgrade ipa-debuginfoUpgrade ipa-client-sambaUpgrade slapi-nis-debuginfoUpgrade slapi-nis-debugsourceUpgrade ipa-serverUpgrade softhsm-debugsourceUpgrade softhsm-develUpgrade ipa-clientUpgrade softhsmUpgrade bind-dyndb-ldap-debuginfoUpgrade opendnssec-debugsourceUpgrade ipa-client-debuginfoUpgrade opendnssec-debuginfoUpgrade opendnssecUpgrade slapi-nisUpgrade ipa-server-trust-adUpgrade ipa-server-trust-ad-debuginfoUpgrade bind-dyndb-ldapUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-debugsourceUpgrade ipa-client-epnUpgrade softhsm-debuginfo | Feb 5, 2026 | Nov 21, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub