CVE-2026-14476: SSSD path traversal in AD GPO provider

CVE-2026-14476 · Severity: high · CVSS 8 · Published 2026-07-07

A security vulnerability exists in the System Security Services Daemon (SSSD), a component used in Linux environments to manage identity and authentication. An attacker with administrative access to Active Directory Group Policy Objects (GPOs) can exploit this flaw to write malicious files to the system with root-level privileges. In practice, this allows an attacker to bypass Kerberos authentication or gain full control over the affected Linux server, potentially leading to unauthorized access to sensitive data and systems.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4. Vendors: Red Hat.

Quick answers

Is CVE-2026-14476 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-14476 being exploited in the wild.
How severe is CVE-2026-14476?
High severity, with a CVSS score of 8, published 7 July 2026.
Which products and versions are affected?
Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 7 affected; Red Hat Enterprise Linux 8 affected; Red Hat Enterprise Linux 9 affected; and 1 more.
Is there a fix for CVE-2026-14476?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14476 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-14476?
Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal flaw exists in the ad_gpo_extract_smb_components() function of SSSD's AD GPO provider. The function fails to sanitize '..' sequences in the gPCFileSysPath LDAP attribute. Due to a discrepancy between how libsmbclient and the Linux kernel resolve these paths, an attacker with AD GPO management privileges can write files outside the intended GPO cache directory as the root user. On RHEL systems with SELinux enforcing, this can be leveraged to inject Kerberos configuration files into /var/lib/sss/pubconf/krb5.include.d/, facilitating a KDC redirection and authentication bypass. On systems where SELinux is disabled or permissive, the flaw allows for arbitrary file writes across the filesystem.

Affected products

  • Red Hat Red Hat Enterprise Linux 7 affected
  • Red Hat Red Hat Enterprise Linux 8 affected
  • Red Hat Red Hat Enterprise Linux 9 affected
  • Red Hat Red Hat Enterprise Linux 10 affected
  • Red Hat Red Hat OpenShift Container Platform 4 affected

Timeline

  • 2026-07-02: disclosed: Initial report in Red Hat Bugzilla
  • 2026-07-07: advisory: NVD and Red Hat published advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.