EUVD-2025-18495Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V8 - Authorization Insufficient granularity of access control
|
| Impact | This vulnerability presents exceptional real-world risk despite limited initial exploitation data. The CVSS 9.1 score reflects the severity accurately: network-accessible (AV:N), low attack complexity (AC:L), requiring high privileges (PR:H) but with changed scope (S:C) and complete impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The PR:H requirement (high privileges needed) is the primary limiting factor—this is not unauthenticated, but applies to service administrators or users with delegated service creation rights, a common scenario in large organizations. The attack is deterministic and non-interactive (UI:N), meaning automated exploitation is feasible. The scope change (S:C) is critical: an attacker with service creation privileges can escalate to full realm administrative control, affecting all systems relying on that FreeIPA realm for authentication. Without EPSS probability data or confirmed KEV/CISA status in this scenario, exploitation likelihood is assessed as HIGH due to: (1) high-privilege requirement matching realistic threat models (malicious admins, compromised service accounts), (2) deterministic, automatable technical impact, and (3) significant business impact (realm compromise = infrastructure compromise). This is a genuine priority vulnerability, not a CVSS inflation issue. |
| Exploit ScenarioDerived | An attacker with service creation privileges in FreeIPA (e.g., delegated service administrator, compromised service account with enrollment permissions) authenticates to the FreeIPA web UI or API. The attacker creates a new Kerberos service principal with krbCanonicalName set to 'admin@REALM'—the same canonical name as the realm's administrative account. FreeIPA, lacking default uniqueness validation, permits this duplicate. The attacker then requests a Kerberos ticket for their newly created service. The KDC, resolving the canonical name 'admin@REALM', issues a ticket containing admin credentials. The attacker uses this ticket to authenticate as the realm administrator, gaining unrestricted access to modify users, groups, policies, and all realm infrastructure. From this position, the attacker can exfiltrate sensitive directory data, create backdoor accounts, modify authentication policies, or disable security controls. Attack complexity is low because the attacker need only perform standard service creation operations; no exploit code or technical sophistication is required beyond understanding FreeIPA's UI/API. Proof-of-concept would consist of: (1) authenticating with high-privilege credentials, (2) creating a service with canonical name matching the admin, (3) retrieving a ticket for that service, and (4) using it to perform administrative actions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 14, 2026
Critical privilege escalation vulnerability in FreeIPA that allows authenticated users with high privileges to create Kerberos services with the same canonical name (krbCanonicalName) as the realm administrator, enabling them to obtain administrative credentials. The vulnerability affects FreeIPA default configurations where uniqueness validation is not enforced, allowing attackers to retrieve Kerberos tickets with admin@REALM credentials and perform unrestricted administrative operations. With a CVSS 9.1 score and network-accessible attack vector, this represents a severe threat to FreeIPA-based identity infrastructures, particularly in environments where service creation permissions are delegated or insufficiently restricted.
RemediationAI
Immediate remediation steps: (1) Apply patches from FreeIPA upstream project addressing krbCanonicalName validation—patch versions should be released to enforce uniqueness constraints at the schema and application layer. (2) Contact Red Hat for RHEL Identity Management advisory patches (RHSA-* advisories). (3) Until patched, implement compensating controls: enforce LDAP schema constraints on krbCanonicalName uniqueness at the directory server level; restrict service creation permissions to trusted administrators only; audit existing services for duplicate canonical names and remove unauthorized entries. (4) Monitor FreeIPA upstream (freeipa.org) and Red Hat (access.redhat.com) for official patches. (5) Implement network segmentation restricting service creation requests to authorized administrative networks. (6) Enable Kerberos audit logging to detect unauthorized ticket requests for admin principals.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FreeIPA is an open-source identity management system built on LDAP, Kerberos, and DNS. The vulnerability stems from inadequate validation of the krbCanonicalName attribute, a critical identifier in Kerberos that uniquely identifies principals in the Key Distribution Center (KDC). CWE-1220 (Insufficient Granularity of Access Control) indicates the root cause: FreeIPA fails to enforce uniqueness constraints at the schema or application level, allowing duplicate canonical names across different service principals. The Kerberos protocol relies on canonical name uniqueness to ensure proper ticket issuance and validation; when an attacker creates a service with the admin's canonical name, the KDC may issue tickets bearing admin credentials to the attacker-controlled service. This is compounded by FreeIPA's default configuration not validating this constraint, making the issue present in standard deployments. The attack leverages the interaction between LDAP object creation (insufficient access control) and Kerberos ticket generation (canonical name collision).
Know when Canonical gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
Executive ViewAI
CVE-2025-4404 is a critical privilege escalation vulnerability in FreeIPA that allows attackers to impersonate domain administrators and gain complete control over identity and access management infrastructure. Organizations using FreeIPA are at immediate risk of unauthorized administrative access, potential credential theft, and sensitive data compromise across their entire domain.
- Restrict FreeIPA administrative interface access via network segmentation and firewall rules to trusted administrative networks only. 2) Implement strict monitoring and alerting on krbCanonicalName attribute modifications and service principal creation attempts. 3) Enable audit logging for all Kerberos ticket issuance and review logs for anomalous admin@REALM credential usage. 4) Implement role-based access controls limiting service creation permissions to essential administrators only. 5) Monitor for suspicious Kerberos tickets bearing admin@REALM credentials. 6) Temporarily disable service creation if business operations permit until patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same technique Privilege Escalation
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | needs-triage | - |
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| upstream | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
| oracular | ignored | end of life, was needs-triage |
| questing | needs-triage | - |
Debian
Bug #1108050| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm | vulnerable | 4.9.11-1 | - |
| trixie | fixed | 4.12.4-1 | - |
| forky, sid | fixed | 4.13.1-1 | - |
| (unstable) | fixed | 4.12.4-1 | unimportant |
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
GitHub PoC
Exploit-DB