FreeIPA Bug Lets Unknown Users Mint Themselves Admin Accounts

Key points

• Red Hat disclosed a flaw chain in FreeIPA that lets a client with no prior login create a Kerberos identity and join the administrators group.
• The attack requires a second flaw in the 389 Directory Server database that FreeIPA relies on to store user accounts.
• FreeIPA is the tool that decides who can log in across Linux networks in many enterprises, universities and government systems.
• Administrators should apply Red Hat's fixes for both components as soon as advisories are published for their distribution.
• No public proof-of-concept exploit has been tied to in-the-wild abuse at the time of writing.

Red Hat has warned of a flaw in FreeIPA, the software many Linux shops use to manage who is allowed to log in where, that lets a stranger walk in and hand themselves the keys.

The bug lets a client that has never authenticated (never proved who it is, never logged in) create a Kerberos identity of its own choosing inside the directory. Kerberos is the ticket system that Linux networks use to vouch for a user once they log in. Because the attacker picks the name, they can plant themselves straight into the administrators group.

That gives full control of the identity system that decides who gets into every server behind it.

What is FreeIPA and why does this matter?

FreeIPA is the central sign-on system for many Linux environments. Think of it as the bouncer's clipboard for a whole company's servers: it holds the list of users, their passwords, their group memberships, and the rules about which machines they can touch.

Under the hood, FreeIPA keeps all of that in a database called 389 Directory Server, which it talks to using LDAP, a decades-old protocol for looking up users and groups. If an attacker can rewrite that clipboard, they can log in as anyone, anywhere the system is trusted.

That is what this chain allows.

How does the attack work?

The attack needs two flaws working together, according to Red Hat's advisory as reported by The Hacker News.

The first flaw sits in FreeIPA itself. It lets an unauthenticated client (a machine that has not signed in and has no credentials) send a request to create a Kerberos principal, the technical name for a Kerberos identity, using any name it likes.

The second flaw sits in the 389 Directory Server database that FreeIPA writes to. Together, the pair let the attacker place that fresh identity into a privileged group, including the administrators group that controls the whole directory.

From there, the account is reusable. The attacker can come back and log in as an administrator whenever they want.

Who is affected?

Anyone running FreeIPA on Red Hat Enterprise Linux, CentOS Stream, Fedora, or a downstream rebuild should treat this as urgent. That includes many universities, government departments and engineering-heavy companies that standardised on FreeIPA rather than Microsoft's Active Directory.

Desktop users and the general public are not directly at risk. The exposure sits on the servers their IT teams manage.

What should administrators do now?

Watch Red Hat's security advisories for the FreeIPA and 389-ds-base packages and patch both. Fixing only one side of the chain is not enough, because the attack needs both flaws to succeed.

While waiting for packages, restrict network access to the FreeIPA server so that only trusted management networks can reach the Kerberos and LDAP ports. Review the administrators group and any other privileged groups for accounts you do not recognise, especially ones created recently.

If you find one, treat the directory as compromised and rotate credentials from the top down.