FreeIPA EUVD-2026-56977

Exploitation requires the target FreeIPA deployment to have at least one Active Directory trust configured - the trust-fetch-domains command is only relevant and invocable in deployments where an AD trust relationship exists. The attacker must hold a valid, authenticated IPA user account (PR:L per CVSS vector); unauthenticated external actors cannot exploit this flaw. Critically, the attacker must also operate or control an AD-compatible server and supply credentials accepted by that server, as they must direct FreeIPA to fetch domain data from an attacker-controlled endpoint - this is the source of the AC:H (High Complexity) rating and the primary limiting factor. Exploitation is therefore constrained to authenticated insider threats or scenarios involving a compromised IPA account combined with attacker-controlled AD infrastructure. Organizations where all IPA users are fully trusted employees and where network egress from the IPA server to arbitrary AD endpoints is blocked face substantially reduced real-world risk.

The CVSS 8.2 score with S:C (scope change) is driven by the vulnerability's ability to write attacker-controlled data into FreeIPA's LDAP identity store - a component external to the vulnerable command itself - with C:H and I:H indicating serious confidentiality and integrity risk to cross-realm identity mappings. However, the EPSS score of 0.19% (9th percentile) and SSVC ratings of exploitation=none and technical impact=partial both present a materially lower urgency signal than the raw CVSS severity; this discrepancy is consistent with the AC:H complexity requirement, which demands the attacker operate a malicious AD-compatible server - a non-trivial precondition that blocks automated or opportunistic mass exploitation, as confirmed by SSVC's 'Automatable: no.' The absence of KEV listing and any identified POC means current real-world exploitation risk is low-to-moderate for most organizations. The SSVC 'partial' technical impact rating may understate long-term risk: corrupted ID-range or trusted-domain data can cascade into privilege escalation paths if an attacker manipulates how AD principals are mapped to IPA roles. Organizations running FreeIPA with active AD trusts in sensitive or multi-tenant environments should treat this as a priority remediation item despite the low EPSS, given that identity infrastructure compromise is asymmetrically damaging relative to typical application-layer vulnerabilities.

An authenticated IPA user with no administrative privileges connects to the FreeIPA server over the network and invokes the trust-fetch-domains command, specifying an attacker-controlled Active Directory-compatible server and a set of credentials accepted by that server. The malicious server returns crafted trusted-domain metadata and ID-range records, which FreeIPA writes into its LDAP directory as authoritative identity data. This corrupts cross-realm identity mappings, enabling subsequent privilege escalation or lateral movement by manipulating how AD users and groups are resolved within the IPA environment. No public POC has been identified at the time of analysis.