CVE-2024-2698

Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service

A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() function: If the target service argument is NULL, then it means the KDC is probing for general constrained delegation rules and not checking a specific S4U2Proxy request. In FreeIPA 4.11.0, the behavior of ipadb_match_acl() was modified to match the changes from upstream MIT Kerberos 1.20. However, a mistake resulting in this mechanism applies in cases where the target service argument is set AND where it is unset. This results in S4U2Proxy requests being accepted regardless of whether or not there is a matching service delegation rule.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux Enterprise Linux Eus and 2 more

CVE-2026-73196

Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding

A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a denial of service, degrading the availability of the IPA service.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux Rhel Els

CVE-2026-11861

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2023-5455

Ipa: invalid csrf protection

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Freeipa Redhat

Products

Fedora Freeipa Codeready Linux Builder and 23 more

CVE-2026-73198

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-73197

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-19550

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-13097

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2016-7030

ipa: DoS attack against kerberized services by abusing password policy

FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in which system services run on.

CVSS 3.0 · 7.5 High EPSS 4.7% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux

CVE-2015-5179

FreeIPA: non-printable characters aren't checked in every case of user data

FreeIPA might display user data improperly via vectors involving non-printable characters.

CVSS 3.0 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Freeipa

Products

Freeipa

CVE-2017-11191

ipa: Session reuse to unlock the locked user

FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same user account) that had been created for an earlier session. NOTE: Vendor states that issue does not exist in product and does not recognize this report as a valid security concern

CVSS 3.0 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Freeipa

Products

Freeipa

CVE-2016-5414

freeipa: incorrect check for SubjectAltNames during CA ACL check

FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.

CVSS 3.0 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Freeipa

Products

Freeipa

CVE-2015-5284

ipa: ipa-kra-install includes certificate and private key in world readable file

ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.

CVSS 3.0 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Freeipa

Products

Freeipa

CVE-2014-7828

freeipa: password not required when OTP in use

FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.

CVSS 2.0 · 3.5 Low EPSS 2.1% KEV · Not listed

Vendors

Freeipa

Products

Freeipa

CVE-2016-5404

ipa: Insufficient privileges check in certificate revocation

The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.

CVSS 3.0 · 6.5 Medium EPSS 2.6% KEV · Not listed

Vendors

Fedoraproject Freeipa Oracle and 1 more

Products

Fedora Freeipa Linux and 1 more

CVE-2015-1827

ipa: memory corruption when using get_user_grouplist()

The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups.

CVSS 2.0 · 5.0 Medium EPSS 2.6% KEV · Not listed

Vendors

Fedoraproject Freeipa Redhat

Products

Fedora Freeipa Enterprise Linux

CVE-2014-7850

freeipa: XSS flaw can be used to escalate privileges

Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.

CVSS 2.0 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Freeipa

Products

Freeipa

CVE-2020-1722

ipa: No password length restriction leads to denial of service

A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux

CVE-2019-14867

ipa: Denial of service in IPA server due to wrong use of ber_scanf()

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.

CVSS 3.1 · 8.8 High EPSS 7.4% KEV · Not listed

Vendors

Fedoraproject Freeipa Redhat

Products

Fedora Freeipa Enterprise Linux and 1 more

CVE-2019-14826

ipa: Session not terminated after logout

A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux