CVE-2025-4404

Freeipa: idm: privilege escalation from host to domain admin in freeipa

CRITICAL 9.1

At a glance

Source: NVD
EPSS: EPSS 1.99 % · percentile 81 (2026-10-28)
State: PUBLISHED
Published: 2025-06-17 13:39 UTC
Updated: 2026-06-30 10:40 UTC
Assigner: redhat
NVD status: Deferred

Description

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Weaknesses (CWE)

CWE-1220 — Insufficient Granularity of Access Control

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	redhat
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	NVD · secalert@redhat.com (Secondary)

European references

ENISA EUVD · EUVD-2025-18495
GCVE · GCVE-0-2025-4404

Affected products

Product	Versions
freeipa	affected 0 < 4.12.4
Red Hat · Red Hat Enterprise Linux 10	unaffected 0:4.12.2-15.el10_0.1 < *
Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support	unaffected 0:4.6.8-5.el7_9.18 < *
Red Hat · Red Hat Enterprise Linux 8	unaffected 8100020250603150652.143e9e98 < *
Red Hat · Red Hat Enterprise Linux 8	unaffected 8100020250603134209.823393f5 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Support	unaffected 8020020250609031831.50ea30f9 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Support	unaffected 8020020250609030144.792f4060 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	unaffected 8040020250609101903.f153676a < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	unaffected 8040020250609095221.5b01ab7e < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	unaffected 8060020250606060927.c1533a64 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	unaffected 8060020250606060504.ada582f1 < *
Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Service	unaffected 8060020250606060927.c1533a64 < *
Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Service	unaffected 8060020250606060504.ada582f1 < *
Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	unaffected 8060020250606060927.c1533a64 < *
Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	unaffected 8060020250606060504.ada582f1 < *
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service	unaffected 8080020250604195510.e581a9e4 < *
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service	unaffected 8080020250604202433.b0a6ceea < *
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	unaffected 8080020250604195510.e581a9e4 < *
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	unaffected 8080020250604202433.b0a6ceea < *
Red Hat · Red Hat Enterprise Linux 9	unaffected 0:4.12.2-14.el9_6.1 < *

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD