REDHAT-BUG-2487472: Medium severity FreeIPA FreeIPA vulnerability

Published Jun 10, 2026

Updated

If trust relationship between FreeIPA and Active Directory is configured (established/created), AD users can bypass authentication of the FreeIPA portal, SMB server, LDAP directory and, presumably, any other GSSAPI services unauthorized, using impersonation in TGS, under certain conditions. In the worst case scenario a user could escalate their priveleges (permissions/rights) in FreeIPA domain. This is due to the fact that the portal, like other GSSAPI services, is not configured to verify PAC certificates and trusts the TGS cname field.

Affected Software

1 affected component

FreeIPA FreeIPA

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Update/configure FreeIPA GSSAPI services to verify PAC certificates and trusts (so impersonation in TGS using the TGS cname field cannot bypass authentication).
FreeIPA GSSAPI services (portal/SMB/LDAP) PAC certificate and trust validation for TGS cname handling = configured to verify PAC certificates and trusts instead of trusting the TGS cname field
Compensating control
Ensure the FreeIPA-to-Active Directory trust relationship is not established/created unless required; if it is configured, limit exposure by preventing AD users from authenticating to FreeIPA GSSAPI services (portal/SMB/LDAP) where impersonation via TGS could bypass authentication.

Event History

Jun 10, 2026

Data Sourced

via Red Hat·11:50 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Is a FreeIPA deployment without an established trust relationship to Active Directory in scope?

The issue is described only for environments where a trust relationship between FreeIPA and Active Directory has been configured and established.

What access would an attacker need to attempt exploitation?

The attacker would need to be an Active Directory user and use TGS impersonation under the unspecified conditions required by the issue. Successful exploitation can bypass authentication to affected GSSAPI services and may enable privilege escalation in the FreeIPA domain.

Which FreeIPA services should be treated as potentially exposed in a trusted environment?

The FreeIPA portal, SMB server, and LDAP directory are explicitly identified. Other GSSAPI services should also be considered potentially affected because they may rely on the same trust of the TGS cname field without PAC certificate verification.

REDHAT-BUG-2487472: Medium severity FreeIPA FreeIPA vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Is a FreeIPA deployment without an established trust relationship to Active Directory in scope?

What access would an attacker need to attempt exploitation?

Which FreeIPA services should be treated as potentially exposed in a trusted environment?

Company

Resources

Contact

Frequently Asked Questions

Is a FreeIPA deployment without an established trust relationship to Active Directory in scope?

What access would an attacker need to attempt exploitation?

Which FreeIPA services should be treated as potentially exposed in a trusted environment?