{"id":"CVE-2026-115221","kind":"vulnerability","aliases":["CVE-2026-115221"],"related":[],"title":"FreeIPA: enrolled hosts can retrieve and revoke other entities' certificates","description":"A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name (CN), without confirming actual ownership in the directory service. Consequently, an enrolled host can disrupt services by revoking certificates belonging to other entities.","summary":"FreeIPA checks certificate ownership only by matching the host name to the certificate's subject Common Name, without confirming ownership in the directory. An authenticated enrolled host can retrieve and revoke certificates belonging to other users or services, disrupting those services.","severity":"medium","cvss":5.4,"epss":0.00145,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["certificates","freeipa","identity","infrastructure","self-hosted"],"not_affected_if":["no-enrolled-hosts"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-22T22:18:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:14:17+00:00","updated_at":"2026-10-25T04:14:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:14:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FreeIPA: enrolled hosts can retrieve and revoke other entities' certificates","impact":"medium","summary":"FreeIPA checks certificate ownership only by matching the host name to the certificate's subject Common Name, without confirming ownership in the directory. An authenticated enrolled host can retrieve and revoke certificates belonging to other users or services, disrupting those services.","category":"infrastructure","nicknames":[],"who_cares":["freeipa","self-hosted","identity","certificates"],"confidence":0.6,"needs_auth":"yes","worst_case":"Other services lose valid certificates through attacker-triggered revocation","analyst_note":"Find affected and fixed FreeIPA versions and the upstream fix commit via the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115221.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-enrolled-hosts"],"who_is_affected":"Deployments of FreeIPA where enrolled hosts can authenticate and certificates are issued to users or services. Installations without enrolled hosts that can reach the certificate API are less exposed. The sources do not name affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000571,"input_tokens":3375,"output_tokens":467,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115221':13A,16A '-2026':12A,15A 'actual':114C 'allow':75C 'assign':85C 'authent':48B,77C 'author':73C 'belong':56B,130C 'certif':10A,17B,26B,36B,55B,84C,106C,129C 'check':25B,74C 'cn':111C 'common':39B,109C 'confirm':42B,113C 'consequ':120C 'cve':11A,14A 'digit':83C 'directori':46B,118C 'disrupt':62B,125C 'enrol':2A,49B,122C 'entiti':9A,133C 'flaw':66C 'found':68C 'freeipa':1A,18B,24B,70C,95C 'host':3A,23B,32B,50B,78C,102C,123C 'ident':19B 'improp':72C 'infrastructur':20B 'issu':92C 'match':30B,100C 'name':33B,40B,103C,110C 'occur':93C 'ownership':27B,43B,97C,115C 'retriev':5A,52B,80C 'revok':7A,54B,82C,128C 'self':22B 'self-host':21B 'servic':61B,64B,90C,119C,126C 'sole':98C 'subject':38B,108C 'user':59B,88C 'verifi':96C 'without':41B,112C","nicknames":[],"mitigations":[],"who_affected":"Deployments of FreeIPA where enrolled hosts can authenticate and certificates are issued to users or services. Installations without enrolled hosts that can reach the certificate API are less exposed. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T22:18:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115221","severity":null,"published_at":"2026-10-22T22:18:06+00:00","modified_at":"2026-10-23T16:44:17+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115221","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115221","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}