Description

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-20T11:16:19.270Z",
  "pubdate": "2026-08-20T11:16:19.270Z",
  "executiveSummary": "A critical security flaw has been identified in FreeIPA concerning trust relationships established with Active Directory (AD). This vulnerability arises from the failure of FreeIPA services to properly verify Privilege Attribute Certificate (PAC) data during Kerberos Ticket Granting Service (TGS) request processing. Consequently, authenticated Active Directory users are capable of bypassing standard authentication mechanisms for various integrated FreeIPA services, such as the portal, Server Message Block (SMB) server, and Lightweight Directory Access Protocol (LDAP) directory.\nThe risk implications are severe, as this flaw enables unauthorized horizontal and vertical privilege escalation within the FreeIPA domain. An attacker possessing valid Active Directory credentials can construct and present manipulated TGS requests containing arbitrary client principal identities. Because the target FreeIPA services fail to cryptographically validate or inspect the embedded PAC assertions against trusted authority signatures, the system incorrectly accepts the fraudulent claims as legitimate.\nExploitation of this vulnerability requires an existing authenticated session within the trusted Active Directory domain, granting the attacker baseline access to initiate Kerberos ticket exchanges. The impact spans confidentiality, integrity, and availability of the FreeIPA domain, potentially allowing a standard AD user to assume administrative privileges across cross-platform enterprise environments.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of Kerberos PAC validation logic within FreeIPA service components when handling cross-realm authentication tickets derived from an Active Directory trust relationship. In a standard Kerberos architecture utilizing Microsoft Active Directory, the Privilege Attribute Certificate (PAC) is embedded within the ticket payload to securely transmit security identifier (SID) information, group memberships, and authorization data signed by the Key Distribution Center (KDC).\nDuring the authentication flow, when an Active Directory user accesses FreeIPA domain resources (including the portal, SMB server, and LDAP directory), the service tickets presented to these components are not subjected to rigorous PAC signature verification and identity binding checks. Specifically, the vulnerable components fail to validate the cryptographic integrity of the PAC or cross-reference the asserted client principal name inside the TGS request against the identity declared within the validated PAC structure.\nThis architectural oversight allows an authenticated attacker within the Active Directory domain to engage in client name impersonation. The exploitation method involves manipulating the TGS exchange or leveraging custom ticket generation techniques where the attacker requests a service ticket for a FreeIPA resource while injecting an arbitrary administrative or high-privileged client principal name into the ticket structures.\nThe attack flow proceeds as follows: First, the adversary establishes an authenticated foothold within the Active Directory domain. Second, the attacker interacts with the Kerberos infrastructure to request service tickets destined for FreeIPA services, manipulating the payload or exploiting the lack of strict principal-to-PAC mapping validation. Third, the attacker transmits the forged TGS request to vulnerable FreeIPA services such as the LDAP directory, SMB server, or portal endpoints. Fourth, because the receiving FreeIPA services omit the requisite PAC verification routines, they blindly trust the unverified client identifier presented in the ticket. Finally, the service grants access under the assumed identity, successfully achieving privilege escalation and unauthorized access to protected domain resources."
}