A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade softhsmUpgrade ipa-healthcheck-coreUpgrade python3-pyusbUpgrade python3-custodiaUpgrade python3-ipaclientUpgrade python3-qrcode-coreUpgrade ipa-client-commonUpgrade python3-qrcodeUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade ipa-server-encrypted-dnsUpgrade bind-dyndb-ldapUpgrade python3-kdcproxyUpgrade ipa-client-sambaUpgrade ipa-python-compatUpgrade slapi-nisUpgrade python3-ipaserverUpgrade opendnssecUpgrade ipa-client-encrypted-dnsUpgrade custodiaUpgrade ipa-healthcheckUpgrade ipa-selinux-nfastUpgrade ipa-server-trust-adUpgrade ipa-server-commonUpgrade python3-jwcryptoUpgrade python3-ipalibUpgrade softhsm-develUpgrade ipa-serverUpgrade ipa-clientUpgrade ipa-commonUpgrade ipa-selinux-lunaUpgrade python3-ipatestsUpgrade ipa-selinuxUpgrade python3-yubico | Oct 6, 2025 | Oct 1, 2025 |
| Amazon Linux Ami 2 | — | Upgrade ipa-clientUpgrade ipa-commonUpgrade ipa-serverUpgrade python2-ipaserverUpgrade ipa-server-trust-adUpgrade 389-ds-base-develUpgrade python2-ipaclientUpgrade 389-ds-base-debuginfoUpgrade 389-ds-baseUpgrade 389-ds-base-libsUpgrade 389-ds-base-snmpUpgrade ipa-debuginfoUpgrade ipa-client-commonUpgrade ipa-server-commonUpgrade ipa-python-compatUpgrade ipa-server-dnsUpgrade python2-ipalib | May 20, 2026 | May 20, 2026 |
| Oracle_linux | — | Upgrade ipa-selinuxUpgrade ipa-healthcheck-coreUpgrade python3-ipaserverUpgrade python2-ipaclientUpgrade ipa-client-epnUpgrade ipa-client-encrypted-dnsUpgrade ipa-healthcheckUpgrade slapi-nisUpgrade python2-ipaserverUpgrade python3-ipatestsUpgrade ipa-selinux-lunaUpgrade ipa-commonUpgrade python3-kdcproxyUpgrade python3-jwcryptoUpgrade python2-ipalibUpgrade ipa-server-encrypted-dnsUpgrade python3-custodiaUpgrade opendnssecUpgrade ipa-client-sambaUpgrade python3-ipalibUpgrade ipa-serverUpgrade python3-qrcode-coreUpgrade ipa-server-commonUpgrade ipa-server-dnsUpgrade ipa-selinux-nfastUpgrade python3-yubicoUpgrade custodiaUpgrade softhsm-develUpgrade python3-ipaclientUpgrade ipa-python-compatUpgrade bind-dyndb-ldapUpgrade python3-qrcodeUpgrade ipa-client-commonUpgrade ipa-server-trust-adUpgrade ipa-clientUpgrade python3-pyusbUpgrade softhsm | Oct 2, 2025 | Sep 30, 2025 |
| Redhat_linux | — | Upgrade opendnssec-debugsourceUpgrade python3-qrcode-coreUpgrade softhsm-debugsourceUpgrade softhsm-develUpgrade ipa-serverUpgrade opendnssec-debuginfoUpgrade python3-pyusbUpgrade slapi-nis-debugsourceUpgrade softhsm-debuginfoUpgrade ipa-debugsourceUpgrade ipa-selinux-nfastNo solution existsUpgrade python3-ipalibUpgrade softhsmUpgrade ipa-server-debuginfoUpgrade ipa-client-commonUpgrade ipa-clientUpgrade custodiaUpgrade ipa-healthcheck-coreUpgrade slapi-nis-debuginfoUpgrade python3-yubicoUpgrade ipa-server-trust-adUpgrade slapi-nisUpgrade ipa-selinux-lunaUpgrade python2-ipaclientUpgrade python2-ipaserverUpgrade ipa-client-debuginfoUpgrade python3-kdcproxyUpgrade ipa-server-encrypted-dnsUpgrade ipa-client-sambaUpgrade ipa-client-epnUpgrade bind-dyndb-ldap-debugsourceUpgrade python3-ipatestsUpgrade ipa-server-commonUpgrade python3-ipaserverUpgrade ipa-python-compatUpgrade ipa-server-dnsUpgrade ipa-healthcheckUpgrade ipa-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade python3-jwcryptoUpgrade python3-ipaclientUpgrade bind-dyndb-ldapUpgrade ipa-client-encrypted-dnsUpgrade python3-custodiaUpgrade opendnssecUpgrade ipa-server-trust-ad-debuginfoUpgrade python2-ipalibUpgrade ipa-commonUpgrade ipa-selinuxUpgrade python3-qrcode | Oct 1, 2025 | Sep 30, 2025 |
| Rocky_linux | — | Upgrade opendnssec-debugsourceUpgrade softhsm-develUpgrade bind-dyndb-ldapUpgrade slapi-nis-debugsourceUpgrade softhsm-debugsourceUpgrade ipa-client-debuginfoUpgrade ipa-server-trust-adUpgrade opendnssec-debuginfoUpgrade ipa-debuginfoUpgrade ipa-server-encrypted-dnsUpgrade ipa-server-debuginfoUpgrade softhsmUpgrade ipa-debugsourceUpgrade opendnssecUpgrade slapi-nisUpgrade ipa-server-trust-ad-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-client-encrypted-dnsUpgrade softhsm-debuginfoUpgrade ipa-serverUpgrade ipa-client-sambaUpgrade ipa-clientUpgrade slapi-nis-debuginfoUpgrade ipa-client-epnUpgrade bind-dyndb-ldap-debugsource | Feb 5, 2026 | Nov 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub