CVE-2025-4404: Insufficient Granularity of Access Control
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
AI Analysis
Technical Summary
CVE-2025-4404 is a privilege escalation vulnerability in FreeIPA's IdM component of Red Hat Enterprise Linux 10. The flaw allows an attacker with host-level access to escalate privileges to domain administrator level. Red Hat has released security updates for multiple variants of Red Hat Enterprise Linux 10 and CodeReady Linux Builder to remediate this vulnerability. The advisory classifies the severity as Important (high) and provides updated packages to fix the issue.
Potential Impact
Successful exploitation of this vulnerability allows an attacker with host access to escalate privileges to domain administrator, potentially gaining full control over the identity management domain. This could lead to unauthorized access and control over authentication and authorization within the enterprise environment.
Mitigation Recommendations
Red Hat has released security updates for Red Hat Enterprise Linux 10 and related products to fix this vulnerability. Users should apply the updates as described in the Red Hat advisory RHSA-2025:9190 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are specified beyond applying the official patches.
CVE-2025-4404: Insufficient Granularity of Access Control
Description
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
CVSS v3.1
Score 9.1critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-4404 is a privilege escalation vulnerability in FreeIPA's IdM component of Red Hat Enterprise Linux 10. The flaw allows an attacker with host-level access to escalate privileges to domain administrator level. Red Hat has released security updates for multiple variants of Red Hat Enterprise Linux 10 and CodeReady Linux Builder to remediate this vulnerability. The advisory classifies the severity as Important (high) and provides updated packages to fix the issue.
Potential Impact
Successful exploitation of this vulnerability allows an attacker with host access to escalate privileges to domain administrator, potentially gaining full control over the identity management domain. This could lead to unauthorized access and control over authentication and authorization within the enterprise environment.
Mitigation Recommendations
Red Hat has released security updates for Red Hat Enterprise Linux 10 and related products to fix this vulnerability. Users should apply the updates as described in the Red Hat advisory RHSA-2025:9190 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are specified beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:9190
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- null
Threat ID: 6a3da1cd4853345fc1823956
Added to database: 06/25/2026, 21:46:53 UTC
Last enriched: 06/25/2026, 22:06:56 UTC
Last updated: 07/05/2026, 08:51:20 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.