A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-commonUpgrade slapi-nisUpgrade ipa-selinux-lunaUpgrade ipa-server-trust-adUpgrade ipa-server-commonUpgrade ipa-clientUpgrade python3-ipatestsUpgrade ipa-client-encrypted-dnsUpgrade python3-ipaserverUpgrade python3-jwcryptoUpgrade opendnssecUpgrade ipa-selinux-nfastUpgrade ipa-healthcheckUpgrade python3-ipalibUpgrade ipa-selinuxUpgrade python3-yubicoUpgrade custodiaUpgrade ipa-serverUpgrade softhsm-develUpgrade softhsmUpgrade python3-kdcproxyUpgrade python3-pyusbUpgrade ipa-server-dnsUpgrade bind-dyndb-ldapUpgrade python3-ipaclientUpgrade ipa-client-commonUpgrade python3-custodiaUpgrade python3-qrcode-coreUpgrade ipa-healthcheck-coreUpgrade ipa-client-sambaUpgrade python3-qrcodeUpgrade ipa-python-compatUpgrade ipa-client-epnUpgrade ipa-server-encrypted-dns | Oct 6, 2025 | Oct 1, 2025 |
| Amazon Linux Ami 2 | — | Upgrade ipa-clientUpgrade python2-ipaserverUpgrade 389-ds-base-libsUpgrade ipa-serverUpgrade 389-ds-baseUpgrade ipa-server-trust-adUpgrade python2-ipaclientUpgrade ipa-commonUpgrade 389-ds-base-debuginfoUpgrade 389-ds-base-develUpgrade 389-ds-base-snmpUpgrade ipa-server-commonUpgrade ipa-debuginfoUpgrade ipa-python-compatUpgrade python2-ipalibUpgrade ipa-client-commonUpgrade ipa-server-dns | May 20, 2026 | May 20, 2026 |
| Oracle_linux | — | Upgrade ipa-healthcheckUpgrade slapi-nisUpgrade ipa-healthcheck-coreUpgrade ipa-selinuxUpgrade ipa-selinux-lunaUpgrade python3-ipaserverUpgrade ipa-commonUpgrade python3-ipatestsUpgrade ipa-client-encrypted-dnsUpgrade python2-ipaclientUpgrade python2-ipaserverUpgrade ipa-client-epnUpgrade python3-jwcryptoUpgrade python3-pyusbUpgrade python3-ipalibUpgrade ipa-serverUpgrade python2-ipalibUpgrade ipa-server-encrypted-dnsUpgrade ipa-selinux-nfastUpgrade ipa-server-dnsUpgrade python3-yubicoUpgrade python3-kdcproxyUpgrade ipa-server-commonUpgrade ipa-client-commonUpgrade custodiaUpgrade bind-dyndb-ldapUpgrade softhsm-develUpgrade python3-ipaclientUpgrade ipa-server-trust-adUpgrade ipa-python-compatUpgrade ipa-clientUpgrade python3-qrcodeUpgrade softhsmUpgrade python3-custodiaUpgrade opendnssecUpgrade ipa-client-sambaUpgrade python3-qrcode-core | Oct 2, 2025 | Sep 30, 2025 |
| Redhat_linux | — | Upgrade python3-ipaclientUpgrade python3-ipatestsUpgrade ipa-client-encrypted-dnsUpgrade python3-qrcodeUpgrade ipa-server-encrypted-dnsUpgrade ipa-selinuxUpgrade bind-dyndb-ldap-debugsourceUpgrade python3-custodiaUpgrade python3-ipaserverUpgrade ipa-server-trust-ad-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-debuginfoUpgrade python3-jwcryptoUpgrade ipa-healthcheckUpgrade ipa-python-compatUpgrade bind-dyndb-ldapUpgrade opendnssecUpgrade ipa-client-sambaUpgrade ipa-commonUpgrade ipa-client-epnUpgrade python2-ipalibUpgrade ipa-server-dnsUpgrade ipa-server-commonUpgrade ipa-clientUpgrade python3-yubicoUpgrade ipa-healthcheck-coreUpgrade slapi-nisUpgrade python3-kdcproxyUpgrade python2-ipaclientUpgrade slapi-nis-debuginfoUpgrade softhsm-develUpgrade ipa-selinux-lunaUpgrade ipa-client-commonUpgrade ipa-debugsourceUpgrade opendnssec-debugsourceUpgrade python2-ipaserverUpgrade ipa-client-debuginfoUpgrade ipa-selinux-nfastUpgrade python3-ipalibUpgrade softhsm-debuginfoUpgrade softhsm-debugsourceUpgrade softhsmUpgrade ipa-server-debuginfoUpgrade python3-pyusbUpgrade slapi-nis-debugsourceUpgrade opendnssec-debuginfoNo solution existsUpgrade python3-qrcode-coreUpgrade ipa-serverUpgrade custodiaUpgrade ipa-server-trust-ad | Oct 1, 2025 | Sep 30, 2025 |
| Rocky_linux | — | Upgrade slapi-nis-debuginfoUpgrade bind-dyndb-ldap-debugsourceUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-client-sambaUpgrade ipa-server-trust-ad-debuginfoUpgrade softhsm-debuginfoUpgrade ipa-serverUpgrade ipa-client-encrypted-dnsUpgrade ipa-clientUpgrade ipa-client-epnUpgrade ipa-debugsourceUpgrade opendnssec-debugsourceUpgrade softhsm-debugsourceUpgrade opendnssecUpgrade ipa-server-encrypted-dnsUpgrade softhsmUpgrade ipa-server-trust-adUpgrade ipa-server-debuginfoUpgrade slapi-nis-debugsourceUpgrade opendnssec-debuginfoUpgrade softhsm-develUpgrade bind-dyndb-ldapUpgrade ipa-debuginfoUpgrade ipa-client-debuginfoUpgrade slapi-nis | Feb 5, 2026 | Nov 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub