A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.
CVSS Details
- CVSS 3.1 Base Score: 8.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade freeipa-server | Sep 18, 2026 | Sep 11, 2026 |
| Redhat_linux | — | Upgrade ipa-selinux-nfastUpgrade ipa-server-trust-ad-debuginfoNo solution existsUpgrade ipa-client-encrypted-dnsUpgrade ipa-selinux-lunaUpgrade ipa-selinuxUpgrade ipa-server-debuginfoUpgrade python3-ipatestsUpgrade ipa-client-epnUpgrade ipa-commonUpgrade python3-ipaserverUpgrade ipa-debugsourceUpgrade ipa-client-debuginfoUpgrade ipa-serverUpgrade ipa-client-commonUpgrade ipa-debuginfoUpgrade ipa-server-trust-adUpgrade ipa-server-commonUpgrade ipa-client-sambaUpgrade python3-ipaclientUpgrade ipa-server-encrypted-dnsUpgrade ipa-clientUpgrade python3-ipalibUpgrade ipa-server-dns | Aug 24, 2026 | Aug 20, 2026 |
| Rocky_linux | — | Upgrade ipa-server-trust-ad-debuginfoUpgrade ipa-client-debuginfoUpgrade ipa-debugsourceUpgrade ipa-server-debuginfoUpgrade ipa-clientUpgrade ipa-client-encrypted-dnsUpgrade ipa-serverUpgrade ipa-server-trust-adUpgrade ipa-client-epnUpgrade ipa-server-encrypted-dnsUpgrade ipa-client-sambaUpgrade ipa-debuginfo | Sep 28, 2026 | Sep 24, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub