Skip to main content
Public proof of conceptFix available

CVE-2025-4404

Freeipa: idm: privilege escalation from host to domain admin in freeipa

A public proof of concept exists; no exploitation attested.

  • Published2025-06-17
  • WeaknessCWE-1220

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Timeline

dates in UTC
  1. 2025-06-1713:39CVE publishedCNA
  2. 2025-06-1714:15CVE publishedNVD

Versions per branch

Products declared by the CNA24 products

As redhat, the CNA that assigned this CVE, declared them in the CVE record; versions as written.

18 more products in the CVE record.

Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of UseCVE recordupdated 2026-11-04

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • bind-dyndb-ldapRocky Linux:8all versions · fixed in 0:11.6-6.module+el8.10.0+1960+1ed527b3
  • bind-dyndb-ldapRed Hat:rhel_tus:8.8::appstreamall versions · fixed in 0:11.6-4.module+el8.8.0+21675+157fa23b.2and 2 other packages
  • bind-dyndb-ldapRed Hat:rhel_tus:8.6::appstreamall versions · fixed in 0:11.6-4.module+el8.6.0+21751+4d78cb83.3and 2 other packages
  • bind-dyndb-ldapRed Hat:rhel_e4s:8.8::appstreamall versions · fixed in 0:11.6-4.module+el8.8.0+21675+157fa23b.2and 2 other packages
  • bind-dyndb-ldapRed Hat:rhel_e4s:8.6::appstreamall versions · fixed in 0:11.6-4.module+el8.6.0+21751+4d78cb83.3and 2 other packages
  • bind-dyndb-ldapRed Hat:rhel_aus:8.6::appstreamall versions · fixed in 0:11.6-4.module+el8.6.0+21751+4d78cb83.3and 2 other packages
  • bind-dyndb-ldapRed Hat:rhel_aus:8.4::appstreamall versions · fixed in 0:11.6-2.module+el8.4.0+21736+855b82c8.1and 2 other packages
  • bind-dyndb-ldapRed Hat:rhel_aus:8.2::appstreamall versions · fixed in 0:11.2-3.module+el8.2.0+21753+7109ce90.3and 2 other packages

152 more package ranges on OSV.dev

Vendor advisories

  • CVE-2025-4404 Red Hat Product Security1,119 products fixed · 7 known affected

    freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA

    ipa-admintools as a component of Red Hat Enterprise Linux 6 · ipa-client as a component of Red Hat Enterprise Linux 6 · ipa-python as a component of Red Hat Enterprise Linux 6 · +4 more

  • RHSA-2025:9188 Red Hat Product Security166 products fixed

    Red Hat Security Advisory: idm:DL1 security update

  • RHSA-2025:9192 Red Hat Product Security324 products fixed

    Red Hat Security Advisory: idm:DL1 security update

  • RHSA-2025:9186 Red Hat Product Security50 products fixed

    Red Hat Security Advisory: ipa security update

  • RHSA-2025:9190 Red Hat Product Security60 products fixed

    Red Hat Security Advisory: ipa security update

  • RHSA-2025:9184 Red Hat Product Security60 products fixed

    Red Hat Security Advisory: ipa security update

6 more advisories

Full record on NVD

Fix

  1. Vendor fix Red Hat Product Security RHSA-2025:9188 · 166 productsFor details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
  2. Workaround from the vendor Red Hat Product Security RHSA-2025:9188 · 166 productsNo mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

Detection

read 2026-11-01 01:02 UTC
Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof of concept
Metasploit modules
none listed
Metasploit Framework

Sources

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Published
2025-06-17
Last Modified
2026-11-04
NVD status
Deferred
GitHub Advisory
GHSA-w66p-wgwc-mqmw

Frequently asked questions

What is CVE-2025-4404?

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Is CVE-2025-4404 actively exploited?

Active exploitation of CVE-2025-4404 has not been confirmed. Its EPSS score was 2.0% on 2026-11-08, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-4404?

CVE-2025-4404 has a CVSS v3 base score of 9.1 (CRITICAL severity), with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Running freeIPA? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record