CVE-2025-4404: Freeipa: idm: privilege escalation from host to domain admin in freeipa

Security readout for executives and security teams

CVE-2025-4404 is a critical FreeIPA/Red Hat IdM flaw that can let a highly privileged host-level user become domain admin. If successful, the attacker could administer the identity realm and access or exfiltrate sensitive data. Treat affected IdM servers as high-priority identity infrastructure. Exposure is most likely in organizations running FreeIPA or Red Hat IdM on affected RHEL 7 ELS, 8 AppStream/AUS/E4S/TUS/SAP, 9, or 10 streams listed in the source bundle. Internet exposure is not required; the risk is inside identity administration boundaries. Prioritize within emergency identity-management patching. The flaw needs privileged access, but a successful compromise can convert delegated host or service control into domain-wide administrative control. Mitigation focus: Identify all FreeIPA and Red Hat IdM deployments and package streams.; Apply the relevant Red Hat security advisory updates for each affected RHEL stream.; Prioritize IdM servers before ordinary member systems..

Prepared

Jun 30, 2026, 14:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.