CVE-2025-4404: Freeipa: idm: privilege escalation from host to domain admin in freeipa

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-17 · updated 2026-06-30
Weakness: CWE-1220

Description

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Affected products

Red Hat Enterprise Linux 10: all versions — fixed in 0:4.12.2-15.el10_0.1
Red Hat Enterprise Linux 7 Extended Lifecycle Support: all versions — fixed in 0:4.6.8-5.el7_9.18
Red Hat Enterprise Linux 8: all versions — fixed in 8100020250603134209.823393f5, 8100020250603150652.143e9e98
Red Hat Enterprise Linux 8.2 Advanced Update Support: all versions — fixed in 8020020250609030144.792f4060, 8020020250609031831.50ea30f9
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: all versions — fixed in 8040020250609095221.5b01ab7e, 8040020250609101903.f153676a
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 8060020250606060504.ada582f1, 8060020250606060927.c1533a64
Red Hat Enterprise Linux 8.6 Telecommunications Update Service: all versions — fixed in 8060020250606060504.ada582f1, 8060020250606060927.c1533a64
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions: all versions — fixed in 8060020250606060504.ada582f1, 8060020250606060927.c1533a64
Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 8080020250604195510.e581a9e4, 8080020250604202433.b0a6ceea
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 8080020250604195510.e581a9e4, 8080020250604202433.b0a6ceea
Red Hat Enterprise Linux 9: all versions — fixed in 0:4.12.2-14.el9_6.1
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions: all versions — fixed in 0:4.9.8-11.el9_0.4
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:4.10.1-12.el9_2.4
Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 0:4.11.0-15.el9_4.5

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:4.12.2-15.el10_0.1; Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:4.6.8-5.el7_9.18; Red Hat Enterprise Linux 8 8100020250603134209.823393f5, 8100020250603150652.143e9e98; Red Hat Enterprise Linux 8.2 Advanced Update Support 8020020250609030144.792f4060, 8020020250609031831.50ea30f9; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020250609095221.5b01ab7e, 8040020250609101903.f153676a; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020250606060504.ada582f1, 8060020250606060927.c1533a64; Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020250606060504.ada582f1, 8060020250606060927.c1533a64; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020250606060504.ada582f1, 8060020250606060927.c1533a64; Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020250604195510.e581a9e4, 8080020250604202433.b0a6ceea; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020250604195510.e581a9e4, 8080020250604202433.b0a6ceea; Red Hat Enterprise Linux 9 0:4.12.2-14.el9_6.1; Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:4.9.8-11.el9_0.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-4404 or the next vulnerability affects your stack