A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
Workaround:
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
| Link | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2025:9184 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2025:9185 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2025:9186 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2025:9187 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2025:9188 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2025:9189 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2025:9190 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2025:9191 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2025:9192 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2025:9193 | vendor advisory |
| https://access.redhat.com/errata/RHSA-2025:9194 | vendor advisory |
| https://access.redhat.com/security/cve/CVE-2025-4404 | vdb entry |
| https://bugzilla.redhat.com/show_bug.cgi?id=2364606 | issue tracking |