A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-jwcryptoUpgrade custodiaUpgrade softhsm-develUpgrade ipa-server-commonUpgrade opendnssecUpgrade ipa-serverUpgrade python3-ipalibUpgrade ipa-selinux-nfastUpgrade python3-ipatestsUpgrade ipa-healthcheckUpgrade ipa-selinuxUpgrade ipa-commonUpgrade ipa-selinux-lunaUpgrade ipa-client-encrypted-dnsUpgrade slapi-nisUpgrade python3-yubicoUpgrade ipa-clientUpgrade python3-ipaserverUpgrade ipa-server-trust-adUpgrade softhsmUpgrade bind-dyndb-ldapUpgrade python3-qrcode-coreUpgrade ipa-client-commonUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade ipa-healthcheck-coreUpgrade ipa-server-encrypted-dnsUpgrade python3-qrcodeUpgrade ipa-python-compatUpgrade python3-kdcproxyUpgrade python3-ipaclientUpgrade python3-pyusbUpgrade ipa-client-sambaUpgrade python3-custodia | Oct 6, 2025 | Oct 1, 2025 |
| Amazon Linux Ami 2 | — | Upgrade 389-ds-base-snmpUpgrade python2-ipalibUpgrade ipa-debuginfoUpgrade ipa-server-dnsUpgrade ipa-server-commonUpgrade ipa-python-compatUpgrade ipa-client-commonUpgrade python2-ipaserverUpgrade 389-ds-base-libsUpgrade ipa-serverUpgrade 389-ds-baseUpgrade python2-ipaclientUpgrade 389-ds-base-develUpgrade 389-ds-base-debuginfoUpgrade ipa-clientUpgrade ipa-server-trust-adUpgrade ipa-common | May 20, 2026 | May 20, 2026 |
| Oracle_linux | — | Upgrade python3-kdcproxyUpgrade softhsm-develUpgrade python3-ipaclientUpgrade custodiaUpgrade bind-dyndb-ldapUpgrade python3-ipalibUpgrade python3-jwcryptoUpgrade ipa-serverUpgrade ipa-server-dnsUpgrade python3-yubicoUpgrade python3-pyusbUpgrade ipa-server-commonUpgrade ipa-selinux-nfastUpgrade ipa-client-commonUpgrade ipa-server-trust-adUpgrade softhsmUpgrade python2-ipalibUpgrade ipa-server-encrypted-dnsUpgrade ipa-clientUpgrade ipa-client-sambaUpgrade python3-custodiaUpgrade opendnssecUpgrade python3-qrcode-coreUpgrade ipa-python-compatUpgrade python3-qrcodeUpgrade ipa-client-epnUpgrade ipa-client-encrypted-dnsUpgrade ipa-selinuxUpgrade ipa-selinux-lunaUpgrade ipa-healthcheckUpgrade ipa-commonUpgrade python3-ipatestsUpgrade slapi-nisUpgrade python2-ipaserverUpgrade ipa-healthcheck-coreUpgrade python3-ipaserverUpgrade python2-ipaclient | Oct 2, 2025 | Sep 30, 2025 |
| Redhat_linux | — | Upgrade slapi-nis-debuginfoUpgrade python2-ipaclientUpgrade python3-kdcproxyUpgrade ipa-client-commonUpgrade ipa-selinux-nfastUpgrade ipa-clientUpgrade softhsm-debugsourceUpgrade ipa-server-trust-adUpgrade python3-yubicoUpgrade softhsmUpgrade ipa-selinux-lunaUpgrade python3-pyusbUpgrade ipa-client-debuginfoUpgrade ipa-healthcheck-coreUpgrade softhsm-develUpgrade custodiaUpgrade python3-qrcode-coreUpgrade opendnssec-debugsourceUpgrade slapi-nis-debugsourceUpgrade ipa-debugsourceUpgrade ipa-serverUpgrade opendnssec-debuginfoUpgrade python2-ipaserverUpgrade ipa-server-debuginfoUpgrade slapi-nisUpgrade softhsm-debuginfoUpgrade python3-ipalibNo solution existsUpgrade ipa-server-encrypted-dnsUpgrade python3-jwcryptoUpgrade ipa-client-encrypted-dnsUpgrade ipa-client-sambaUpgrade ipa-client-epnUpgrade ipa-server-commonUpgrade bind-dyndb-ldap-debuginfoUpgrade python3-ipaserverUpgrade python2-ipalibUpgrade ipa-commonUpgrade python3-ipaclientUpgrade ipa-healthcheckUpgrade python3-qrcodeUpgrade ipa-debuginfoUpgrade ipa-server-dnsUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-selinuxUpgrade bind-dyndb-ldapUpgrade python3-ipatestsUpgrade ipa-python-compatUpgrade ipa-server-trust-ad-debuginfoUpgrade opendnssecUpgrade python3-custodia | Oct 1, 2025 | Sep 30, 2025 |
| Rocky_linux | — | Upgrade ipa-client-encrypted-dnsUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-clientUpgrade ipa-client-epnUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-client-sambaUpgrade ipa-serverUpgrade softhsm-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade slapi-nis-debuginfoUpgrade opendnssec-debuginfoUpgrade opendnssecUpgrade slapi-nisUpgrade opendnssec-debugsourceUpgrade ipa-debuginfoUpgrade softhsm-develUpgrade softhsm-debugsourceUpgrade ipa-debugsourceUpgrade bind-dyndb-ldapUpgrade ipa-server-trust-adUpgrade ipa-server-debuginfoUpgrade slapi-nis-debugsourceUpgrade softhsmUpgrade ipa-client-debuginfoUpgrade ipa-server-encrypted-dns | Feb 5, 2026 | Nov 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub