Freeipa
35 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Freeipa, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Freeipa CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 1 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 1 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 1 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 6 |
| 2026-09 | 0 |
Severity
How the 35 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical4
- High15
- Medium15
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Freeipa.
- CVE-2026-11861Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships9.6
- CVE-2026-73198Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read7.5
- CVE-2026-13097Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore8.7
- CVE-2026-73196Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding4.3
- CVE-2026-73197Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read7.5
- CVE-2026-19550Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes8.2
- CVE-2025-7493Freeipa: idm: privilege escalation from host to domain admin in freeipa9.1
- CVE-2025-4404Freeipa: idm: privilege escalation from host to domain admin in freeipa9.1
- CVE-2024-11029Freeipa: administrative user data leaked through systemd journal5.5
- CVE-2024-3183Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force8.1
- CVE-2024-2698Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service8.8
- CVE-2024-1481Freeipa: specially crafted http requests potentially lead to denial of service5.3
- CVE-2023-5455Ipa: invalid csrf protection6.5
- CVE-2020-1722A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leadin...5.3
- CVE-2019-14867A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some componen...8.8
Product grouping is registry-driven, with AI assist and human review. How it works