FreeIPA EUVD-2026-108516

The attacker must be an enrolled host with a valid host principal in the FreeIPA domain (authenticated, PR:L) - this is the primary limiting factor, excluding anonymous network attackers. The flaw is triggered because FreeIPA authorizes certificate retrieval/revocation solely by matching the requesting host name to the certificate's subject Common Name (CN), without confirming actual ownership in the directory service; any enrolled host that can present or assert a matching CN can therefore act on certificates belonging to other users or services. No special non-default configuration is named in the available description; the constraint is the requirement for an existing enrolled-host identity, after which exploitation is network-reachable and low-complexity.

This is a moderate-severity authorization flaw (CVSS 5.4, vendor-assigned by Red Hat) rather than a top-priority emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L indicates network-reachable, low-complexity exploitation but requires low privileges (PR:L) - specifically an already-enrolled/authenticated host principal in the FreeIPA domain - which meaningfully limits the attacker population to insiders or those who have already compromised a host account. Impact is confined to integrity and availability (I:L/A:L) with no confidentiality loss (C:N); the realistic consequence is denial of service via revoking certificates belonging to other users or services, not data theft or code execution. The vuln.today decision label is 'this_month' (a patch-on-normal-cadence priority, not act_now/emergency). No EPSS score, CISA KEV listing, or public PoC is present in the supplied data, so there is no signal of active or imminent widespread exploitation. The signals are internally consistent: a low-to-moderate CVSS, a non-urgent decision label, and the absence of exploitation indicators all point to a genuine but non-critical issue. The one cross-check worth noting is that the input Tags label this 'Authentication Bypass,' while the description and CWE-863 describe an improper authorization (not authentication) weakness - the attacker is already authenticated.

An attacker who controls any enrolled host in the FreeIPA domain (authenticated as that host principal) requests revocation of a certificate whose subject CN matches a name they can assert, even though the certificate actually belongs to a different user or service. Because FreeIPA checks ownership only by matching the host name to the certificate's subject CN rather than confirming ownership in the directory, the revocation succeeds and disrupts the victim service. No public exploit identified at time of analysis.