A critical vulnerability in FreeIPA enables unauthenticated remote attackers to gain full administrative control over Identity Management services.

The vulnerability stems from a flaw in the self-managed OTP token access control instruction, which lacks authentication requirements and fails to restrict attributes added to the token entry. An unauthenticated attacker can leverage this to create unauthorized Kerberos principals and inject them into the administrator group.

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity. Successful exploitation allows a remote, unauthenticated attacker to achieve complete administrative compromise of the directory server and associated IdM services. This leads to total loss of confidentiality, integrity, and availability for the identity infrastructure, potentially enabling lateral movement across the entire enterprise network.

Immediate Action: Update all affected FreeIPA and Red Hat Identity Management installations to version 4.13.4 immediately.

Proactive Monitoring: Monitor LDAP access logs for unusual administrative group modifications or the creation of suspicious Kerberos principals.

Compensating Controls: If patching is delayed, restrict network access to the FreeIPA service to known, trusted management segments to limit exposure to unauthenticated requests.

Public Exploit Available: Yes — confirmed by Red Hat independently.

Given the critical nature of this flaw and the confirmation of active exploitation in the wild, organizations must prioritize patching their identity management infrastructure. Failure to update to version 4.13.4 leaves the environment vulnerable to total administrative takeover by unauthenticated remote actors.