A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
In plain language
Written by AI from the record
If you run FreeIPA (on Red Hat Enterprise Linux) and it’s reachable from the network, a remote attacker without an account may be able to add themselves as an administrator, giving them full control; you should treat this as a serious issue.
An unauthenticated attacker can exploit a FreeIPA directory ACI weakness in the self-managed-token ACI (via LDAP) to have attacker-controlled entries added to the administrators group, resulting in full administrative control over FreeIPA and linked services.
If you're affected
Full identity system takeover
Account and access changes
Security service disruption
Widespread trust compromise
What is it
Think of FreeIPA as the “front desk” that manages who has access to your systems and services. This issue lets someone who connects from the network without an account quietly register themselves as an administrator, like walking into the building and being added to the security staff list—without being recognized first.
Who is affected
This matters if your business uses FreeIPA running on Red Hat Enterprise Linux to manage identities and authentication for users and services. It’s most relevant if your FreeIPA LDAP endpoint is reachable from the network (the default configuration is reachable), because the attacker does not need an account. This is a risk when the attacker can reach the vulnerable LDAP service from outside your trusted network.
How urgent is it
This is a RED issue because an attacker can gain full administrative control without any account, directly from the network. Even though there’s no clear public dated report of exploitation in the provided findings, the exposure is high and the impact is total identity takeover. Treat it as urgent containment and remediation work.
What to do — in detail
Confirm exposure
Verify where FreeIPA is hosted and whether it is reachable from untrusted networks.
Determine whether inbound LDAP connections to your FreeIPA servers are allowed from the internet, guest Wi‑Fi, partner networks, or other broad segments.
Confirm firewall/security group rules and any reverse proxies/load balancers that might expose LDAP.
Confirm affected software
On each FreeIPA host, record the exact Red Hat Enterprise Linux release and the FreeIPA version/build installed.
Confirm that the vulnerable “self-managed-token ACI” behavior is present in your deployment (vendor documentation/support can confirm this for your specific versions).
Get the official fix
The provided findings state that no fix/patch information is available. Contact Red Hat support (or your managed service provider) for:
Whether a patch or fixed FreeIPA update exists for your exact versions
The upgrade path and any required configuration changes
Any interim mitigations they recommend.
Immediate mitigation (if you cannot yet confirm the fixed release)
Restrict LDAP access to reduce the chance of remote reachability:
Allow LDAP (and any related ports used by FreeIPA) only from approved admin networks/IP addresses or a VPN.
Block all other inbound LDAP traffic to FreeIPA.
If you have internal-only access patterns, ensure the service is not exposed via public routing.
What to monitor
After tightening network access (and after applying any vendor fix once available), monitor for:
Unexpected administrative group membership changes in FreeIPA
Unusual creation of Kerberos principals or admin-equivalent identities
Because the traffic-light verdict is RED and the weakness is remotely triggerable without authentication, treat this as an immediate containment item while waiting for the vendor’s official fix guidance.
Technical context
What’s happening
Weakness: CWE-306 (missing authorization).
Mechanism: FreeIPA’s “self-managed-token ACI” is exploitable through an unauthenticated LDAP client. The ACI does not require authentication and does not properly restrict which attributes can be added alongside the token entry.
Effect: Combined with a related directory server ACI evaluation issue (tracked separately), an attacker can cause an attacker-controlled Kerberos principal to be added to the FreeIPA administrators group.
Attack characteristics (from findings)
Network attack vector.
No authentication required.
No user interaction required.
Reachable in default configuration: yes.
Exploitation and availability of fixes
KEV: not listed.
Press/incidents: no clear dated claim of exploitation and no incidents reported in the provided findings.
Public exploit code: none on record.
Patch availability: no fix/patch information available in the provided findings.
Operational significance
Once an attacker gains genuine administrator-group membership, they can perform administrative operations against the directory and, on SID-enabled deployments, potentially other IdM services—enabling full identity infrastructure compromise.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
