This vulnerability in FreeIPA involves a failure to validate the uniqueness of the krbCanonicalName for the admin account by default. Attackers can create services with the same canonical name as the REALM admin, allowing them to retrieve Kerberos tickets containing admin@REALM credentials. This leads to privilege escalation from host to domain admin, enabling administrative actions and potential data exfiltration within the REALM. The CVSS 3.1 base score is 9.1, indicating critical severity. Red Hat has released security updates for Red Hat Enterprise Linux 9 to fix this issue.

Exploitation of this vulnerability allows an attacker with host-level access to escalate privileges to domain admin within the FreeIPA-managed REALM. This grants the attacker administrative capabilities over the identity management system, potentially leading to unauthorized access to sensitive data and data exfiltration. The vulnerability compromises confidentiality, integrity, and availability of the affected environment.

Red Hat has released official security updates addressing CVE-2025-4404 for Red Hat Enterprise Linux 9, including various architectures and update services. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. The vendor advisory classifies this update as Important and provides detailed package versions for remediation. Patch status is confirmed as available. No additional mitigation steps are specified beyond applying the official updates.