CVE-2026-14476
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A path traversal vulnerability was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.
Risk Assessment
The risk for the organization is the potential bypass of Kerberos authentication by an attacker with AD GPO management access, which could lead to unauthorized access to systems and data.
Recommendation
It is recommended to immediately update SSSD to a version containing the fix for the path traversal vulnerability in the ad_gpo_extract_smb_components() function. Also, restrict AD GPO management privileges to trusted administrators only.
Original NVD description (English source)
A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.