Description

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-20T11:16:20.293Z",
  "pubdate": "2026-08-20T11:16:20.293Z",
  "executiveSummary": "A privilege escalation vulnerability exists in FreeIPA involving the uniqueness constraint enforcement on Kerberos principal name attributes within the 389-ds directory server. The flaw arises because the directory server fails to properly account for equivalent representations of the same principal name.\nThis vulnerability allows an authenticated user who possesses sufficient LDAP write privileges to successfully create a malicious service principal that conflicts with or impersonates an existing, highly privileged service principal.\nBy successfully exploiting this constraint validation failure, an unauthorized actor can trick the Key Distribution Center (KDC) into issuing Kerberos service tickets for sensitive services under the control of the attacker.\nThe ultimate impact of this security deficiency is severe, potentially resulting in full domain compromise across the affected infrastructure.\nExploitation requires the attacker to already possess valid credentials and sufficient LDAP write privileges within the directory service to instantiate the overlapping principal object, alongside the ability to leverage the acquired service tickets against sensitive enterprise services.",
  "technicalDetails": "The root cause of this vulnerability lies in the input validation and uniqueness constraint logic implemented by the 389-ds directory server when handling Kerberos principal name attributes for FreeIPA. Kerberos principal names can often be represented in multiple canonically equivalent string formats or case variations while still resolving to the exact same security identity.\nWhen a user attempts to provision a new service principal, the 389-ds directory server verifies existing entries against uniqueness plugins or matching rules. However, the directory server fails to normalize or canonicalize these representations adequately. Consequently, it treats a newly submitted representation as unique, even though it semantically maps to an already registered, privileged service principal.\nThe attack flow proceeds as follows: First, the adversary authenticates to the FreeIPA domain utilizing an account granted sufficient LDAP write privileges to create directory objects, specifically service principals. Second, the attacker crafts a service principal entry using an alternative or equivalent representation of an existing privileged service principal (such as a target domain administrative or high-value service principal). Third, because the 389-ds uniqueness constraint validation fails to detect the semantic collision due to the differing representation, the directory server commits the new object into the database.\nOnce the duplicate or overlapping principal is provisioned, the KDC may issue Kerberos service tickets for the sensitive service to the attacker-controlled context depending on ticket resolution order and attribute indexing. Post-exploitation, the attacker acquires unauthorized service tickets, allowing them to authenticate as the sensitive service, forge sessions, interact with protected domain resources, and ultimately achieve full domain compromise."
}