Skip to content
Fencer Intel
critical 9.1

CVE-2025-4404 json

Freeipa: idm: privilege escalation from host to domain admin in freeipa

published last yr. modified 5d ago also EUVD-2025-18495

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits
0
none known

Summary

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Patch / fix

  • freeipa.org freeipa 4.12.4
  • Red Hat Red Hat Enterprise Linux 10 0:4.12.2-15.el10_0.1
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:4.6.8-5.el7_9.18
  • Red Hat Red Hat Enterprise Linux 8 8100020250603134209.823393f5, 8100020250603150652.143e9e98
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 8020020250609030144.792f4060, 8020020250609031831.50ea30f9
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020250609095221.5b01ab7e, 8040020250609101903.f153676a
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020250606060504.ada582f1, 8060020250606060927.c1533a64
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 8060020250606060504.ada582f1, 8060020250606060927.c1533a64
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 8060020250606060504.ada582f1, 8060020250606060927.c1533a64
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020250604195510.e581a9e4, 8080020250604202433.b0a6ceea
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020250604195510.e581a9e4, 8080020250604202433.b0a6ceea
  • Red Hat Red Hat Enterprise Linux 9 0:4.12.2-14.el9_6.1
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:4.9.8-11.el9_0.4
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:4.10.1-12.el9_2.4
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:4.11.0-15.el9_4.5
  • freeipa Debian 14, Debian 13 4.12.4-1

debian advisories DEBIAN-CVE-2025-4404

  • ipa RHEL 10.0 4.12.2-15.el10_0.1
  • ipa-client RHEL 10.0 4.12.2-15.el10_0.1
  • ipa-common RHEL 10.0 4.12.2-15.el10_0.1
  • ipa-server RHEL 10.0 4.12.2-15.el10_0.1
  • ipa-selinux RHEL 10.0 4.12.2-15.el10_0.1
  • ipa-client-epn RHEL 10.0 4.12.2-15.el10_0.1
  • ipa-server-dns RHEL 10.0 4.12.2-15.el10_0.1
  • python3-ipalib RHEL 10.0 4.12.2-15.el10_0.1

red hat advisories RHSA-2025:9194RHSA-2025:9193RHSA-2025:9191RHSA-2025:9192RHSA-2025:9189RHSA-2025:9190

  • ipa-client AlmaLinux 9 4.12.2-14.el9_6.1
  • ipa-common AlmaLinux 9 4.12.2-14.el9_6.1
  • ipa-server AlmaLinux 9 4.12.2-14.el9_6.1
  • ipa-selinux AlmaLinux 9 4.12.2-14.el9_6.1
  • ipa-client-epn AlmaLinux 9 4.12.2-14.el9_6.1
  • ipa-server-dns AlmaLinux 9 4.12.2-14.el9_6.1
  • python3-ipalib AlmaLinux 9 4.12.2-14.el9_6.1
  • ipa-client-samba AlmaLinux 9 4.12.2-14.el9_6.1

almalinux advisories ALSA-2025:9184ALSA-2025:9188ALSA-2025:9190

  • ipa Rocky Linux 9 4.12.2-14.el9_6.1
  • ipa Rocky Linux 10 4.12.2-15.el10_0.1
  • ipa Rocky Linux 8 4.9.13-18.module+el8.10.0+2000+979bf254
  • ipa Rocky Linux 8 4.9.13-18.module+el8.10.0+1999+6893b0f2
  • pyusb Rocky Linux 8 1.0.0-9.1.module+el8.9.0+1371+ffa84eb9
  • pyusb Rocky Linux 8 1.0.0-9.1.module+el8.9.0+1372+09f67869
  • softhsm Rocky Linux 8 2.6.0-5.module+el8.9.0+1371+ffa84eb9
  • custodia Rocky Linux 8 0.6.0-3.module+el8.9.0+1371+ffa84eb9

rocky linux advisories RLSA-2025:9184RLSA-2025:9190RLSA-2025:9188

Is CVE-2025-4404 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-4404 updated cvss 9.1

freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA

  • Red Hat Enterprise Linux 6 ipa, ipa-client, ipa-python, ipa-server, ipa-admintools, ipa-server-selinux, +1 more
    affected: workaround, no fix planned “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
  • Red Hat CodeReady Linux Builder EUS (v.9.4) python3-ipatests 4.11.0-15.el9_4.5
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9186
  • Red Hat Enterprise Linux AppStream (v. 8) ipa 4.9.13-18.module+el8.10.0+23182+cbb72bb2, ipa 4.9.13-18.module+el8.10.0+23183+85190b0c, pyusb 1.0.0-9.1.module+el8.9.0+18911+94941f82, pyusb 1.0.0-9.1.module+el8.9.0+18920+2223d05e, softhsm 2.6.0-5.module+el8.9.0+18911+94941f82, custodia 0.6.0-3.module+el8.9.0+18911+94941f82, +50 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9188
  • Red Hat Enterprise Linux AppStream (v. 9) ipa 4.12.2-14.el9_6.1, ipa-client 4.12.2-14.el9_6.1, ipa-common 4.12.2-14.el9_6.1, ipa-server 4.12.2-14.el9_6.1, ipa-selinux 4.12.2-14.el9_6.1, ipa-client-epn 4.12.2-14.el9_6.1, +12 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9184
  • Red Hat Enterprise Linux AppStream (v. 10) ipa 4.12.2-15.el10_0.1, ipa-client 4.12.2-15.el10_0.1, ipa-common 4.12.2-15.el10_0.1, ipa-server 4.12.2-15.el10_0.1, ipa-selinux 4.12.2-15.el10_0.1, ipa-client-epn 4.12.2-15.el10_0.1, +12 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9190
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.8.4-14.module+el8.2.0+23212+8be8acd6.6, ipa 4.8.4-14.module+el8.2.0+23213+bc8e4dd2.6, softhsm 2.4.0-4.module+el8.2.0+5779+a38c524f, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, +47 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9194
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.9.2-10.module+el8.4.0+23243+ba8c4ec7.2, ipa 4.9.2-10.module+el8.4.0+23244+e11b6684.2, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9193
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.9.8-13.module+el8.6.0+23215+0ea3df7c.2, ipa 4.9.8-13.module+el8.6.0+23216+8ddcf8e6.2, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more Red Hat Enterprise Linux AppStream E4S (v.8.6) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.9.8-13.module+el8.6.0+23215+0ea3df7c.2, ipa 4.9.8-13.module+el8.6.0+23216+8ddcf8e6.2, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9192
show 9 more
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) custodia 0.6.0-3.module+el8.1.0+4098+f286395e, ipa 4.9.11-11.module+el8.8.0+23198+ce79fbfa.2, ipa 4.9.11-11.module+el8.8.0+23199+fd568941.2, pyusb 1.0.0-9.1.module+el8.7.0+15690+c8d45780, pyusb 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9191
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) ipa 4.9.8-11.el9_0.4, ipa-client 4.9.8-11.el9_0.4, ipa-common 4.9.8-11.el9_0.4, ipa-server 4.9.8-11.el9_0.4, ipa-selinux 4.9.8-11.el9_0.4, ipa-client-epn 4.9.8-11.el9_0.4, +8 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9185
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) ipa 4.10.1-12.el9_2.4, ipa-client 4.10.1-12.el9_2.4, ipa-common 4.10.1-12.el9_2.4, ipa-server 4.10.1-12.el9_2.4, ipa-selinux 4.10.1-12.el9_2.4, ipa-client-epn 4.10.1-12.el9_2.4, +8 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9187
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) ipa 4.11.0-15.el9_4.5, ipa-client 4.11.0-15.el9_4.5, ipa-common 4.11.0-15.el9_4.5, ipa-server 4.11.0-15.el9_4.5, ipa-selinux 4.11.0-15.el9_4.5, ipa-client-epn 4.11.0-15.el9_4.5, +8 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9186
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.9.8-13.module+el8.6.0+23215+0ea3df7c.2, ipa 4.9.8-13.module+el8.6.0+23216+8ddcf8e6.2, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9192
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) custodia 0.6.0-3.module+el8.1.0+4098+f286395e, ipa 4.9.11-11.module+el8.8.0+23198+ce79fbfa.2, ipa 4.9.11-11.module+el8.8.0+23199+fd568941.2, pyusb 1.0.0-9.1.module+el8.7.0+15690+c8d45780, pyusb 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9191
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3-ipatests 4.12.2-14.el9_6.1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9184
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-ipatests 4.12.2-15.el10_0.1
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9190
  • Red Hat Enterprise Linux Server (v. 7 ELS) ipa 4.6.8-5.el7_9.18, ipa-client 4.6.8-5.el7_9.18, ipa-common 4.6.8-5.el7_9.18, ipa-server 4.6.8-5.el7_9.18, ipa-server-dns 4.6.8-5.el7_9.18, python2-ipalib 4.6.8-5.el7_9.18, +6 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:9189

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

1.99% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

  • freeipa.org freeipa
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-1220 Insufficient Granularity of Access Control

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.