FreeIPA EUVD-2026-63243

Exploitation requires an account holding sufficient LDAP write privileges within the FreeIPA 389-ds directory to create or modify entries in the Kerberos principal container (cn=services or cn=computers under the FreeIPA suffix). This corresponds to delegated admin roles or accounts explicitly granted write access to krbPrincipalName/krbCanonicalName attributes - not standard user accounts. The target environment must be running FreeIPA with 389-ds as the LDAP backend on RHEL 6-10. The LDAP service must be reachable by the attacker (network access to port 636 or 389). Exploitation is limited by the PR:H requirement: an unauthenticated external attacker or a low-privileged user cannot trigger this flaw. No non-default configuration flag or optional feature needs to be enabled; the vulnerability exists in the default FreeIPA deployment whenever the uniqueness plug-in is active, which is always the case. The limiting factor is the elevated LDAP write privilege - defenders should focus on auditing which accounts hold write access to the Kerberos principal container.

The CVSS base score of 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) reflects the high-privilege prerequisite (PR:H), which significantly constrains the exploitable population to accounts that already hold elevated LDAP write permissions within the FreeIPA domain - typically delegated admins or compromised service accounts. Despite the high score, the EPSS of 0.34% (28th percentile) and SSVC exploitation status of 'none' both signal that real-world opportunistic exploitation has not been observed. SSVC does rate automatable as 'no' and technical impact as 'total,' meaning a skilled attacker who already holds the required privileges can achieve full domain compromise without needing to chain additional techniques. The scope-changed (S:C) metric is credible: Kerberos service ticket forgery affects not just the FreeIPA server but every service in the realm. There is no conflict between CVSS and description signals - the network attack vector is consistent with LDAP being a network-accessible protocol, and the high privilege requirement is explicitly stated in the description. The practical risk is best characterized as an insider threat or post-initial-access privilege escalation vector, not an externally-exploitable perimeter risk.

A delegated FreeIPA administrator or a threat actor who has compromised an account with LDAP write privileges to the Kerberos container crafts a service principal name string that is an equivalent - but not byte-identical - representation of an existing privileged service principal (e.g., the HTTP service principal used by the FreeIPA web UI). The 389-ds uniqueness plug-in allows the duplicate to be written because string normalization is not applied during the uniqueness check. The attacker then uses the rogue principal entry to obtain a Kerberos TGS ticket for the targeted privileged service from the KDC, enabling impersonation of that service and lateral movement to full domain compromise. No public proof-of-concept code has been identified, but the attack does not require exotic tooling - standard Kerberos and LDAP utilities suffice once the primitive is understood.