freeipa vulnerabilities
CVEs whose affected-version data names the freeipa package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-73197High· 7.5A flaw was found in FreeIPA
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-c…
CVE-2026-11861Critical· 9.6A flaw was found in FreeIPA
A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This …
CVE-2026-73198High· 7.5A flaw was found in FreeIPA
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leadin…
CVE-2026-13097High· 8.7A privilege escalation flaw was found in FreeIPA
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name…
CVE-2026-19550High· 8.2A flaw was found in FreeIPA
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged…
CVE-2019-14867High· 8.8Code injection in FreeIPA
Code injection in FreeIPA