CVE-2026-14474
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
Risk Assessment
The organization is at risk of privilege escalation by an authenticated user who can gain full control over all SSSD-enrolled systems, leading to compromise of data confidentiality, integrity, and availability.
Recommendation
Configure the ldap_sudo_search_base option in SSSD to restrict the sudoRole search scope to a specific LDAP subtree, and apply security updates provided by the vendor.
Original NVD description (English source)
A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.