Riskcovery

CVE-2025-4404

Freeipa: idm: privilege escalation from host to domain admin in freeipa

State
Published
Severity
9.1 Critical
Published
Jun 17, 2025
Updated
Jun 30, 2026
Reserved
May 6, 2025

Read the record on cve.org

Description

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hredhat

Weaknesses

  • CWE-1220 Insufficient Granularity of Access Control

Affected Products

ProductVersions
freeipa
  • before 4.12.4Affected
Red Hat Enterprise Linux 10Red Hat
  • 0:4.12.2-15.el10_0.1 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat
  • 0:4.6.8-5.el7_9.18 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 8100020250603150652.143e9e98 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 8100020250603134209.823393f5 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat
  • 8020020250609031831.50ea30f9 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat
  • 8020020250609030144.792f4060 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat
  • 8040020250609101903.f153676a and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat
  • 8040020250609095221.5b01ab7e and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat
  • 8060020250606060927.c1533a64 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat
  • 8060020250606060504.ada582f1 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat
  • 8060020250606060927.c1533a64 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat
  • 8060020250606060504.ada582f1 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat
  • 8060020250606060927.c1533a64 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat
  • 8060020250606060504.ada582f1 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat
  • 8080020250604195510.e581a9e4 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat
  • 8080020250604202433.b0a6ceea and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat
  • 8080020250604195510.e581a9e4 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat
  • 8080020250604202433.b0a6ceea and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:4.12.2-14.el9_6.1 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat
  • 0:4.9.8-11.el9_0.4 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat
  • 0:4.10.1-12.el9_2.4 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat
  • 0:4.11.0-15.el9_4.5 and laterNot affected
Red Hat Enterprise Linux 6Red Hat

    References

    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.