Vulnerability · Published Jun 17, 2025 · Assigned by redhat

CVE-2025-4404Freeipa: idm: privilege escalation from host to domain admin in freeipa

Critical 9.1

In plain English

A critical-severity security flaw in freeipa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)2.0%top 19.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	bind-dyndb-ldap	11.6-6.module_el8.10.0+3980+d78e8e90	ALSA-2025:9188
AlmaLinux:8	custodia	0.6.0-3.module_el8.6.0+2881+2f24dc92	ALSA-2025:9188
AlmaLinux:8	ipa-client	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	ipa-client	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:10	ipa-client-common	4.12.2-15.el10_0.1	ALSA-2025:9190
AlmaLinux:8	ipa-client-common	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	ipa-client-common	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:9	ipa-client-encrypted-dns	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:8	ipa-client-epn	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	ipa-client-epn	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:8	ipa-client-samba	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	ipa-client-samba	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:10	ipa-common	4.12.2-15.el10_0.1	ALSA-2025:9190
AlmaLinux:8	ipa-common	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	ipa-common	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:8	ipa-healthcheck	0.12-5.module_el8.10.0+3980+d78e8e90	ALSA-2025:9188
AlmaLinux:8	ipa-healthcheck-core	0.12-5.module_el8.10.0+3980+d78e8e90	ALSA-2025:9188
AlmaLinux:8	ipa-python-compat	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:10	ipa-selinux	4.12.2-15.el10_0.1	ALSA-2025:9190
AlmaLinux:8	ipa-selinux	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	ipa-selinux	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:10	ipa-selinux-luna	4.12.2-15.el10_0.1	ALSA-2025:9190
AlmaLinux:9	ipa-selinux-luna	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:10	ipa-selinux-nfast	4.12.2-15.el10_0.1	ALSA-2025:9190
AlmaLinux:9	ipa-selinux-nfast	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:8	ipa-server	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	ipa-server	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:10	ipa-server-common	4.12.2-15.el10_0.1	ALSA-2025:9190
AlmaLinux:8	ipa-server-common	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	ipa-server-common	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:10	ipa-server-dns	4.12.2-15.el10_0.1	ALSA-2025:9190
AlmaLinux:8	ipa-server-dns	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	ipa-server-dns	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:9	ipa-server-encrypted-dns	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:8	ipa-server-trust-ad	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	ipa-server-trust-ad	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:8	opendnssec	2.1.7-2.module_el8.10.0+3980+d78e8e90	ALSA-2025:9188
AlmaLinux:8	python3-custodia	0.6.0-3.module_el8.6.0+2881+2f24dc92	ALSA-2025:9188
AlmaLinux:10	python3-ipaclient	4.12.2-15.el10_0.1	ALSA-2025:9190
AlmaLinux:8	python3-ipaclient	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	python3-ipaclient	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:10	python3-ipalib	4.12.2-15.el10_0.1	ALSA-2025:9190
AlmaLinux:8	python3-ipalib	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	python3-ipalib	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:10	python3-ipaserver	4.12.2-15.el10_0.1	ALSA-2025:9190
AlmaLinux:8	python3-ipaserver	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	python3-ipaserver	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:10	python3-ipatests	4.12.2-15.el10_0.1	ALSA-2025:9190
AlmaLinux:8	python3-ipatests	4.9.13-18.module_el8.10.0+4018+32aeeb28	ALSA-2025:9188
AlmaLinux:9	python3-ipatests	4.12.2-14.el9_6.1	ALSA-2025:9184
AlmaLinux:8	python3-jwcrypto	0.5.0-2.module_el8.10.0+3844+20e075e5	ALSA-2025:9188
AlmaLinux:8	python3-kdcproxy	0.4-5.module_el8.10.0+3942+63b39a46.1	ALSA-2025:9188
AlmaLinux:8	python3-pyusb	1.0.0-9.1.module_el8.7.0+3349+cfeff52e	ALSA-2025:9188
AlmaLinux:8	python3-qrcode	5.3-1.module_el8.10.0+3942+63b39a46	ALSA-2025:9188
AlmaLinux:8	python3-qrcode-core	5.3-1.module_el8.10.0+3942+63b39a46	ALSA-2025:9188
AlmaLinux:8	python3-yubico	1.3.2-9.1.module_el8.7.0+3349+cfeff52e	ALSA-2025:9188
AlmaLinux:8	slapi-nis	0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1	ALSA-2025:9188
AlmaLinux:8	softhsm	2.6.0-5.module_el8.6.0+2881+2f24dc92	ALSA-2025:9188
AlmaLinux:8	softhsm	2.6.0-5.module_el8.6.0+3031+2f24dc92	ALSA-2025:9188
AlmaLinux:8	softhsm-devel	2.6.0-5.module_el8.6.0+3031+2f24dc92	ALSA-2025:9188
AlmaLinux:8	softhsm-devel	2.6.0-5.module_el8.6.0+2881+2f24dc92	ALSA-2025:9188
Debian:12	freeipa	no fix listed	DEBIAN-CVE-2025-4404
Debian:13	freeipa	4.12.4-1	DEBIAN-CVE-2025-4404
Rocky Linux:8	bind-dyndb-ldap	0:11.6-6.module+el8.10.0+1960+1ed527b3	RLSA-2025:9188
Rocky Linux:8	custodia	0:0.6.0-3.module+el8.9.0+1371+ffa84eb9	RLSA-2025:9188
Rocky Linux:10	ipa	0:4.12.2-15.el10_0.1	RLSA-2025:9190
Rocky Linux:8	ipa	0:4.9.13-18.module+el8.10.0+1999+6893b0f2	RLSA-2025:9188
Rocky Linux:8	ipa	0:4.9.13-18.module+el8.10.0+2000+979bf254	RLSA-2025:9188
Rocky Linux:9	ipa	0:4.12.2-14.el9_6.1	RLSA-2025:9184
Rocky Linux:8	ipa-healthcheck	0:0.12-5.module+el8.10.0+1959+be225f41	RLSA-2025:9188
Rocky Linux:8	ipa-healthcheck	0:0.12-5.module+el8.10.0+1960+1ed527b3	RLSA-2025:9188
Rocky Linux:8	opendnssec	0:2.1.7-2.module+el8.10.0+1960+1ed527b3	RLSA-2025:9188
Rocky Linux:8	python-jwcrypto	0:0.5.0-2.module+el8.10.0+1818+2dfda7a6	RLSA-2025:9188
Rocky Linux:8	python-jwcrypto	0:0.5.0-2.module+el8.10.0+1819+0aeba2f1	RLSA-2025:9188
Rocky Linux:8	python-kdcproxy	0:0.4-5.module+el8.9.0+1371+ffa84eb9	RLSA-2025:9188
Rocky Linux:8	python-kdcproxy	0:0.4-5.module+el8.10.0+1915+3c70f7d9.1	RLSA-2025:9188
Rocky Linux:8	python-qrcode	0:5.3-1.module+el8.10.0+1916+6bb8cf6b	RLSA-2025:9188
Rocky Linux:8	python-qrcode	0:5.3-1.module+el8.10.0+1915+3c70f7d9	RLSA-2025:9188
Rocky Linux:8	python-yubico	0:1.3.2-9.1.module+el8.9.0+1371+ffa84eb9	RLSA-2025:9188
Rocky Linux:8	python-yubico	0:1.3.2-9.1.module+el8.9.0+1372+09f67869	RLSA-2025:9188
Rocky Linux:8	pyusb	0:1.0.0-9.1.module+el8.9.0+1371+ffa84eb9	RLSA-2025:9188
Rocky Linux:8	pyusb	0:1.0.0-9.1.module+el8.9.0+1372+09f67869	RLSA-2025:9188
Rocky Linux:8	slapi-nis	0:0.60.0-4.module+el8.9.0+1573+39ab85f4	RLSA-2025:9188
Rocky Linux:8	softhsm	0:2.6.0-5.module+el8.9.0+1371+ffa84eb9	RLSA-2025:9188
Ubuntu:22.04:LTS	freeipa	no fix listed	UBUNTU-CVE-2025-4404
Ubuntu:24.04:LTS	freeipa	no fix listed	UBUNTU-CVE-2025-4404
Ubuntu:25.10	freeipa	no fix listed	UBUNTU-CVE-2025-4404
Ubuntu:26.04:LTS	freeipa	no fix listed	UBUNTU-CVE-2025-4404
Ubuntu:26.10	freeipa	no fix listed	UBUNTU-CVE-2025-4404

Affected products (as reported)

Vendor	Product	Versions
	freeipa	0 – before 4.12.4
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 6	see references

Weakness: CWE-1220 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

RHSA-2025:9184 vendor-advisory, x_refsource_REDHAT
RHSA-2025:9185 vendor-advisory, x_refsource_REDHAT
RHSA-2025:9186 vendor-advisory, x_refsource_REDHAT
RHSA-2025:9187 vendor-advisory, x_refsource_REDHAT
RHSA-2025:9188 vendor-advisory, x_refsource_REDHAT
RHSA-2025:9189 vendor-advisory, x_refsource_REDHAT
RHSA-2025:9190 vendor-advisory, x_refsource_REDHAT
RHSA-2025:9191 vendor-advisory, x_refsource_REDHAT
RHSA-2025:9192 vendor-advisory, x_refsource_REDHAT
RHSA-2025:9193 vendor-advisory, x_refsource_REDHAT
RHSA-2025:9194 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2025-4404 vdb-entry, x_refsource_REDHAT
RHBZ#2364606 issue-tracking, x_refsource_REDHAT
https://pagure.io/freeipa/c/6b9400c135ed16b10057b350cc9ce42aa0e862d4
https://pagure.io/freeipa/c/796ed20092d554ee0c9e23295e346ec1e8a0bf6e
http://www.openwall.com/lists/oss-security/2025/09/30/6