CVE-2026-115221
CVE-2026-115221 · Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name (CN), without confirming actual ownership in the directory service. Consequently, an enrolled host can disrupt services by revoking certificates belonging to other entities.
CVSS 5.4 · Medium · EPSS 0.1%
- Published
- Updated
Stack: system
Affected products and versions
red hat enterprise linux 10
No fix published
red hat enterprise linux 6
No fix published
red hat enterprise linux 7
No fix published
red hat enterprise linux 8
No fix published
red hat enterprise linux 9
No fix published
freeipa Debian:12
- Versions
- 4.10.1+dfsg1-1+exp1
- 4.10.1-1+exp1
- 4.10.2-1
- 4.10.2-2
- 4.10.2-2+exp1
- 4.11.1-1
- 4.11.1-1+exp1
- 4.11.1-2
- 4.11.1-2+exp1
- 4.11.1-2.1
- 4.12.2-1
- 4.12.2-2
- 4.12.2-3
- 4.12.4-1
- 4.12.4-2
- 4.13.1-1
- 4.9.11-1
- 4.9.11-1+exp1
- 4.9.11-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
freeipa Debian:13
- Versions
- 4.12.4-1
- 4.12.4-2
- 4.13.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published