CVE-2025-7493 PUBLISHED

Freeipa: idm: privilege escalation from host to domain admin in freeipa

Assigner: redhat
Reserved: 11.07.2025 Published: 30.09.2025 Updated: 26.02.2026

A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.1

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
  • unaffected from 0:4.12.2-15.el10_0.4 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 7 Extended Lifecycle Support
Versions Default: affected
  • unaffected from 0:4.6.8-5.el7_9.23 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
  • unaffected from 8100020250919180242.143e9e98 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
  • unaffected from 8100020250918211722.823393f5 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.2 Advanced Update Support
Versions Default: affected
  • unaffected from 8020020250924110056.50ea30f9 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.2 Advanced Update Support
Versions Default: affected
  • unaffected from 8020020250924104944.792f4060 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Versions Default: affected
  • unaffected from 8040020250923180004.f153676a to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Versions Default: affected
  • unaffected from 8040020250923175408.5b01ab7e to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Versions Default: affected
  • unaffected from 8040020250923180004.f153676a to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Versions Default: affected
  • unaffected from 8040020250923175408.5b01ab7e to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Versions Default: affected
  • unaffected from 8060020250916172436.c1533a64 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Versions Default: affected
  • unaffected from 8060020250916174421.ada582f1 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Versions Default: affected
  • unaffected from 8060020250916172436.c1533a64 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Versions Default: affected
  • unaffected from 8060020250916174421.ada582f1 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
Versions Default: affected
  • unaffected from 8060020250916172436.c1533a64 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
Versions Default: affected
  • unaffected from 8060020250916174421.ada582f1 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Versions Default: affected
  • unaffected from 8080020250918184739.e581a9e4 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Versions Default: affected
  • unaffected from 8080020250918152850.b0a6ceea to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Versions Default: affected
  • unaffected from 8080020250918184739.e581a9e4 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Versions Default: affected
  • unaffected from 8080020250918152850.b0a6ceea to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
  • unaffected from 0:4.12.2-14.el9_6.5 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Versions Default: affected
  • unaffected from 0:4.9.8-11.el9_0.5 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Versions Default: affected
  • unaffected from 0:4.10.1-12.el9_2.6 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 9.4 Extended Update Support
Versions Default: affected
  • unaffected from 0:4.11.0-15.el9_4.7 to * (excl.)
Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unknown

Workarounds

There's no available mitigation other than updating to the package version.

Credits

  • Red Hat would like to thank Tom Smith for reporting this issue.

References

Problem Types

  • Insufficient Granularity of Access Control CWE