Vulnerability · Published Sep 30, 2025 · Assigned by redhat

CVE-2025-7493Freeipa: idm: privilege escalation from host to domain admin in freeipa

Critical 9.1

In plain English

A critical-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.6%top 53.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	bind-dyndb-ldap	11.6-6.module_el8.10.0+3980+d78e8e90	ALSA-2025:17129
AlmaLinux:8	custodia	0.6.0-3.module_el8.6.0+2881+2f24dc92	ALSA-2025:17129
AlmaLinux:8	ipa-client	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	ipa-client	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:9	ipa-client	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:10	ipa-client-common	4.12.2-24.el10_1.1	ALSA-2025:20994
AlmaLinux:8	ipa-client-common	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	ipa-client-common	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:9	ipa-client-common	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:9	ipa-client-encrypted-dns	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:9	ipa-client-encrypted-dns	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:8	ipa-client-epn	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	ipa-client-epn	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:9	ipa-client-epn	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:8	ipa-client-samba	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	ipa-client-samba	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:9	ipa-client-samba	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:10	ipa-common	4.12.2-24.el10_1.1	ALSA-2025:20994
AlmaLinux:8	ipa-common	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	ipa-common	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:9	ipa-common	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:8	ipa-healthcheck	0.12-6.module_el8.10.0+4036+84b152d9	ALSA-2025:17129
AlmaLinux:8	ipa-healthcheck-core	0.12-6.module_el8.10.0+4036+84b152d9	ALSA-2025:17129
AlmaLinux:8	ipa-python-compat	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:10	ipa-selinux	4.12.2-24.el10_1.1	ALSA-2025:20994
AlmaLinux:8	ipa-selinux	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	ipa-selinux	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:9	ipa-selinux	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:10	ipa-selinux-luna	4.12.2-24.el10_1.1	ALSA-2025:20994
AlmaLinux:9	ipa-selinux-luna	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:9	ipa-selinux-luna	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:10	ipa-selinux-nfast	4.12.2-24.el10_1.1	ALSA-2025:20994
AlmaLinux:9	ipa-selinux-nfast	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:9	ipa-selinux-nfast	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:8	ipa-server	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	ipa-server	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:9	ipa-server	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:10	ipa-server-common	4.12.2-24.el10_1.1	ALSA-2025:20994
AlmaLinux:8	ipa-server-common	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	ipa-server-common	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:9	ipa-server-common	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:10	ipa-server-dns	4.12.2-24.el10_1.1	ALSA-2025:20994
AlmaLinux:8	ipa-server-dns	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	ipa-server-dns	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:9	ipa-server-dns	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:9	ipa-server-encrypted-dns	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:9	ipa-server-encrypted-dns	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:8	ipa-server-trust-ad	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	ipa-server-trust-ad	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:9	ipa-server-trust-ad	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:8	opendnssec	2.1.7-2.module_el8.10.0+3980+d78e8e90	ALSA-2025:17129
AlmaLinux:8	python3-custodia	0.6.0-3.module_el8.6.0+2881+2f24dc92	ALSA-2025:17129
AlmaLinux:10	python3-ipaclient	4.12.2-24.el10_1.1	ALSA-2025:20994
AlmaLinux:8	python3-ipaclient	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	python3-ipaclient	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:9	python3-ipaclient	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:10	python3-ipalib	4.12.2-24.el10_1.1	ALSA-2025:20994
AlmaLinux:8	python3-ipalib	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	python3-ipalib	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:9	python3-ipalib	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:10	python3-ipaserver	4.12.2-24.el10_1.1	ALSA-2025:20994
AlmaLinux:8	python3-ipaserver	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	python3-ipaserver	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:9	python3-ipaserver	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:10	python3-ipatests	4.12.2-24.el10_1.1	ALSA-2025:20994
AlmaLinux:8	python3-ipatests	4.9.13-20.module_el8.10.0+4050+3b475c71	ALSA-2025:17129
AlmaLinux:9	python3-ipatests	4.12.2-14.el9_6.5	ALSA-2025:17084
AlmaLinux:9	python3-ipatests	4.12.2-22.el9_7.1	ALSA-2025:20928
AlmaLinux:8	python3-jwcrypto	0.5.0-2.module_el8.10.0+3844+20e075e5	ALSA-2025:17129
AlmaLinux:8	python3-kdcproxy	0.4-5.module_el8.10.0+3942+63b39a46.1	ALSA-2025:17129
AlmaLinux:8	python3-pyusb	1.0.0-9.1.module_el8.7.0+3349+cfeff52e	ALSA-2025:17129
AlmaLinux:8	python3-qrcode	5.3-1.module_el8.10.0+3942+63b39a46	ALSA-2025:17129
AlmaLinux:8	python3-qrcode-core	5.3-1.module_el8.10.0+3942+63b39a46	ALSA-2025:17129
AlmaLinux:8	python3-yubico	1.3.2-9.1.module_el8.7.0+3349+cfeff52e	ALSA-2025:17129
AlmaLinux:8	slapi-nis	0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1	ALSA-2025:17129
AlmaLinux:8	softhsm	2.6.0-5.module_el8.6.0+2881+2f24dc92	ALSA-2025:17129
AlmaLinux:8	softhsm	2.6.0-5.module_el8.6.0+3031+2f24dc92	ALSA-2025:17129
AlmaLinux:8	softhsm-devel	2.6.0-5.module_el8.6.0+3031+2f24dc92	ALSA-2025:17129
AlmaLinux:8	softhsm-devel	2.6.0-5.module_el8.6.0+2881+2f24dc92	ALSA-2025:17129
Debian:12	freeipa	no fix listed	DEBIAN-CVE-2025-7493
Debian:13	freeipa	no fix listed	DEBIAN-CVE-2025-7493
Rocky Linux:8	bind-dyndb-ldap	0:11.6-6.module+el8.10.0+1960+1ed527b3	RLSA-2025:17129
Rocky Linux:8	custodia	0:0.6.0-3.module+el8.9.0+1371+ffa84eb9	RLSA-2025:17129
Rocky Linux:10	ipa	0:4.12.2-15.el10_0.4	RLSA-2025:17085
Rocky Linux:10	ipa	0:4.12.2-24.el10_1.1	RLSA-2025:20994
Rocky Linux:8	ipa	0:4.9.13-20.module+el8.10.0+2067+377bdd64	RLSA-2025:17129
Rocky Linux:8	ipa	0:4.9.13-20.module+el8.10.0+2066+d74ade98	RLSA-2025:17129
Rocky Linux:9	ipa	0:4.12.2-22.el9_7.1	RLSA-2025:20928
Rocky Linux:9	ipa	0:4.12.2-14.el9_6.5	RLSA-2025:17084
Rocky Linux:8	ipa-healthcheck	0:0.12-6.module+el8.10.0+2053+a0a9dc19	RLSA-2025:17129
Rocky Linux:8	ipa-healthcheck	0:0.12-6.module+el8.10.0+2054+aa003774	RLSA-2025:17129
Rocky Linux:8	opendnssec	0:2.1.7-2.module+el8.10.0+1960+1ed527b3	RLSA-2025:17129
Rocky Linux:8	python-jwcrypto	0:0.5.0-2.module+el8.10.0+1818+2dfda7a6	RLSA-2025:17129
Rocky Linux:8	python-jwcrypto	0:0.5.0-2.module+el8.10.0+1819+0aeba2f1	RLSA-2025:17129
Rocky Linux:8	python-kdcproxy	0:0.4-5.module+el8.10.0+1915+3c70f7d9.1	RLSA-2025:17129
Rocky Linux:8	python-kdcproxy	0:0.4-5.module+el8.10.0+2094+d7886766.2	RLSA-2025:17129
Rocky Linux:8	python-kdcproxy	0:0.4-5.module+el8.9.0+1371+ffa84eb9	RLSA-2025:17129
Rocky Linux:8	python-qrcode	0:5.3-1.module+el8.10.0+1915+3c70f7d9	RLSA-2025:17129
Rocky Linux:8	python-qrcode	0:5.3-1.module+el8.10.0+1916+6bb8cf6b	RLSA-2025:17129
Rocky Linux:8	python-yubico	0:1.3.2-9.1.module+el8.9.0+1372+09f67869	RLSA-2025:17129
Rocky Linux:8	python-yubico	0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9	RLSA-2025:17129
Rocky Linux:8	pyusb	0:1.0.0-9.1.module+el8.9.0+1372+09f67869	RLSA-2025:17129
Rocky Linux:8	pyusb	0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9	RLSA-2025:17129
Rocky Linux:8	slapi-nis	0:0.60.0-4.module+el8.9.0+1573+39ab85f4	RLSA-2025:17129
Rocky Linux:8	softhsm	0:2.6.0-5.module+el8.9.0+1371+ffa84eb9	RLSA-2025:17129
Ubuntu:22.04:LTS	freeipa	no fix listed	UBUNTU-CVE-2025-7493
Ubuntu:24.04:LTS	freeipa	no fix listed	UBUNTU-CVE-2025-7493
Ubuntu:25.10	freeipa	no fix listed	UBUNTU-CVE-2025-7493
Ubuntu:26.04:LTS	freeipa	no fix listed	UBUNTU-CVE-2025-7493
Ubuntu:26.10	freeipa	no fix listed	UBUNTU-CVE-2025-7493

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 6	see references

Weakness: CWE-1220 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

RHSA-2025:17084 vendor-advisory, x_refsource_REDHAT
RHSA-2025:17085 vendor-advisory, x_refsource_REDHAT
RHSA-2025:17086 vendor-advisory, x_refsource_REDHAT
RHSA-2025:17087 vendor-advisory, x_refsource_REDHAT
RHSA-2025:17088 vendor-advisory, x_refsource_REDHAT
RHSA-2025:17129 vendor-advisory, x_refsource_REDHAT
RHSA-2025:17645 vendor-advisory, x_refsource_REDHAT
RHSA-2025:17646 vendor-advisory, x_refsource_REDHAT
RHSA-2025:17647 vendor-advisory, x_refsource_REDHAT
RHSA-2025:17648 vendor-advisory, x_refsource_REDHAT
RHSA-2025:17649 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-7493 vdb-entry, x_refsource_REDHAT
RHBZ#2389448 issue-tracking, x_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2025/09/30/6