CVE-2025-4404

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Scoring

Severity

CRITICAL

CVSS base score

9.1

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS probability

1.97%

CWE

CWE-1220

Published

2025-06-17

Last modified

2026-06-30

Affected products

• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
• Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
• Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
• Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

Weakness type

• CWE-1220

Related vulnerabilities

• CVE-2026-77480 — SQL Server Elevation of Privilege Vulnerability
• CVE-2026-66814 — Microsoft SQL Server Elevation of Privilege Vulnerability
• CVE-2026-69267 — Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability
• CVE-2026-78216 — AshLua eval read operations can read field-policy-protected fields via aggregates
• CVE-2026-78230 — AshAi aggregate tool can read field-policy-protected fields
• CVE-2026-15431 — HP Support Assistant – Potential Escalation of Privilege
• CVE-2026-78122 — docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems
• CVE-2026-40145 — Control protections bypass in BeyondTrust Endpoint Privilege Management (Windows deployment) support utility

Markdown version · Browse all CVEs