Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service (CVE-2024-2698)

Why this deserves its current priority

CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps freeipa (generic), Red Hat/ipa (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
freeipageneric	>=4.11.0 <4.11.2 \|\| >=4.12.0 <4.12.1	4.11.2, 4.12.1
Red Hat/ipageneric	*	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for freeipa, Red Hat/ipa.
Review the reported fix. Source-reported workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Evidence timeline and material changes

Published upstream
Jun 12, 2024
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Nov 7, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Nov 7, 2026

Sources and claim methodology

Upstream source description

A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() function: If the target service argument is NULL, then it means the KDC is probing for general constrained delegation rules and not checking a specific S4U2Proxy request. In FreeIPA 4.11.0, the behavior of ipadb_match_acl() was modified to match the changes from upstream MIT Kerberos 1.20. However, a mistake resulting in this mechanism applies in cases where the target service argument is set AND where it is unset. This results in S4U2Proxy requests being accepted regardless of whether or not there is a matching service delegation rule.

Quoted source text, attributed separately from HOL analysis.

Freeipa: delegation rules allow a proxy service to impersonate any user to access another target serviceCVE-2024-2698