Executive brief
A security vulnerability exists in the System Security Services Daemon (SSSD), a component used in Linux environments to manage identity and authentication. An attacker with administrative access to Active Directory Group Policy Objects (GPOs) can exploit this flaw to write malicious files to the system with root-level privileges. In practice, this allows an attacker to bypass Kerberos authentication or gain full control over the affected Linux server, potentially leading to unauthorized access to sensitive data and systems.
Technical details
A path traversal flaw exists in the ad_gpo_extract_smb_components() function of SSSD's AD GPO provider. The function fails to sanitize '..' sequences in the gPCFileSysPath LDAP attribute. Due to a discrepancy between how libsmbclient and the Linux kernel resolve these paths, an attacker with AD GPO management privileges can write files outside the intended GPO cache directory as the root user. On RHEL systems with SELinux enforcing, this can be leveraged to inject Kerberos configuration files into /var/lib/sss/pubconf/krb5.include.d/, facilitating a KDC redirection and authentication bypass. On systems where SELinux is disabled or permissive, the flaw allows for arbitrary file writes across the filesystem.
Affected products
- Red Hat Red Hat Enterprise Linux 7 affected
- Red Hat Red Hat Enterprise Linux 8 affected
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
- Red Hat Red Hat OpenShift Container Platform 4 affected
Timeline
- 2026-07-02: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-07: advisory: NVD and Red Hat published advisory details