A flaw in FreeIPA allows an attacker with authenticated Active Directory credentials to impersonate a client name in the Ticket Granting Service. FreeIPA services do not verify the Privilege Attribute Certificate, so the attacker can gain unauthenticated access to portal, SMB, and LDAP services within the FreeIPA domain. The result is an elevation of privileges and potential full compromise of the FreeIPA environment.

Red Hat Enterprise Linux 10, 6, 7, 8, and 9 are affected. The vulnerability pertains to the FreeIPA services that run on these operating systems.

The vulnerability carries a CVSS score of 9.6 and is not yet listed in the CISA KEV catalog. Exploitation requires an existing trust relationship between FreeIPA and Active Directory and an authenticated AD user. Because the attack vector depends on trust configuration, mitigation is best done by disabling unsupported trust relationships or applying vendor patches when available. The lack of a publicly documented EPSS score indicates uncertain current exploitation prevalence, but the high severity score warrants immediate attention.