Description

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-11T21:17:35.087Z",
  "pubdate": "2026-08-11T21:17:35.087Z",
  "executiveSummary": "A permission validation flaw exists in FreeIPA involving the trust-fetch-domains command. The vulnerability allows an authenticated, non-privileged IPA user to execute privileged Active Directory trust refresh operations due to improper access control enforcement.\nSpecifically, the command is gated by a read-only permission on the trust object rather than the required trust-administration permission. This authorization bypass enables an attacker to supply an arbitrary server and credentials.\nSuccessful exploitation results in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data stored within the IPA LDAP directory.\nThe risk implications include integrity compromise of identity mapping, potential information disclosure, and unauthorized manipulation of cross-realm trust configurations.\nPrerequisites for exploitation include valid authentication to the IPA domain as a non-privileged user and network access to initiate the trust fetch operation.",
  "technicalDetails": "The root cause of the vulnerability lies in broken access control within the FreeIPA authorization framework. The trust-fetch-domains command, responsible for querying and updating Active Directory trust relationships, fails to enforce the administrative privileges typically required for trust management.\nInstead of verifying the caller's authorization against the strict trust-administration permission, the access control check incorrectly validates the request against a standard read-only permission assigned to the trust object.\nConsequently, an authenticated, non-privileged IPA user can invoke the vulnerable command and supply an attacker-controlled server along with arbitrary credentials.\nThe attack flow proceeds as follows: First, the low-privileged user authenticates to the IPA environment. Second, the user issues the trust-fetch-domains command, passing malicious or external parameters pointing to an attacker-controlled Active Directory controller or rogue server.\nThird, the FreeIPA server processes the request, bypassing the expected privilege boundary due to the permissive read-only check. Fourth, the system initiates a trust refresh operation against the attacker-supplied endpoint, incorporating the malicious payload.\nFinally, the response from the rogue server is processed and written directly to the IPA LDAP directory, resulting in unauthorized modification of trusted-domain attributes and ID-range identity data.\nThe affected component is the trust management subsystem within FreeIPA, specifically the access control logic governing the trust-fetch-domains routine. The exposure vector requires network access to the IPA API or command-line interface and valid low-privileged user credentials.\nPost-exploitation impact includes corrupted directory synchronization, altered ID mapping ranges which may facilitate identity spoofing or denial of service, and compromised trust integrity between the IPA domain and external Active Directory realms."
}