Vulnerability · Published Jul 7, 2026 · Assigned by redhat

CVE-2026-14474Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

High 8.8

In plain English

A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.6%top 52.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:10	libipa_hbac	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libipa_hbac	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libipa_hbac	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	libsss_autofs	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libsss_autofs	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libsss_autofs	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	libsss_certmap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libsss_certmap	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libsss_certmap	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	libsss_idmap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libsss_idmap	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libsss_idmap	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	libsss_nss_idmap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libsss_nss_idmap	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libsss_nss_idmap	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	libsss_nss_idmap-devel	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libsss_nss_idmap-devel	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:8	libsss_simpleifp	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libsss_simpleifp	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	libsss_sudo	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libsss_sudo	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libsss_sudo	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	python3-libipa_hbac	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	python3-libipa_hbac	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	python3-libipa_hbac	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	python3-libsss_nss_idmap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	python3-libsss_nss_idmap	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	python3-libsss_nss_idmap	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	python3-sss	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	python3-sss	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	python3-sss	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	python3-sss-murmur	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	python3-sss-murmur	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	python3-sss-murmur	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	python3-sssdconfig	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	python3-sssdconfig	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	python3-sssdconfig	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-ad	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-ad	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-ad	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-client	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-client	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-client	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-common	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-common	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-common	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-common-pac	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-common-pac	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-common-pac	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-dbus	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-dbus	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-dbus	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-idp	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-idp	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:10	sssd-ipa	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-ipa	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-ipa	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-kcm	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-kcm	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-kcm	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-krb5	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-krb5	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-krb5	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-krb5-common	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-krb5-common	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-krb5-common	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-ldap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-ldap	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-ldap	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-nfs-idmap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-nfs-idmap	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-nfs-idmap	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-passkey	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-polkit-rules	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:10	sssd-proxy	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-proxy	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-proxy	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-tools	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-tools	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:10	sssd-winbind-idmap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-winbind-idmap	2.9.4-5.el8_10.5	ALSA-2026:46990
Debian:12	sssd	no fix listed	DEBIAN-CVE-2026-14474
Debian:13	sssd	no fix listed	DEBIAN-CVE-2026-14474
Rocky Linux:10	sssd	0:2.12.0-3.el10_2.1	RLSA-2026:41937
Rocky Linux:8	sssd	0:2.9.4-5.el8_10.5	RLSA-2026:46990
Rocky Linux:9	sssd	0:2.9.8-4.el9_8.1	RLSA-2026:42122
Ubuntu:22.04:LTS	sssd	no fix listed	UBUNTU-CVE-2026-14474
Ubuntu:24.04:LTS	sssd	no fix listed	UBUNTU-CVE-2026-14474
Ubuntu:25.10	sssd	no fix listed	UBUNTU-CVE-2026-14474
Ubuntu:26.04:LTS	sssd	no fix listed	UBUNTU-CVE-2026-14474
Ubuntu:26.10	sssd	no fix listed	UBUNTU-CVE-2026-14474

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	see references
Red Hat	Red Hat OpenShift Container Platform 4.12	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.14	see references
Red Hat	Red Hat OpenShift Container Platform 4.15	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.17	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.19	see references
Red Hat	Red Hat OpenShift Container Platform 4.20	see references
Red Hat	Red Hat OpenShift Container Platform 4.21	see references
Red Hat	Red Hat OpenShift Container Platform 4.22	see references
Red Hat	Red Hat Enterprise Linux 6	see references
Red Hat	Red Hat OpenShift Container Platform 5	see references

Weakness: CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

RHSA-2026:41937 vendor-advisory, x_refsource_REDHAT
RHSA-2026:42122 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46482 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46990 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49839 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49840 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49841 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49842 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49843 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49844 vendor-advisory, x_refsource_REDHAT
RHSA-2026:50109 vendor-advisory, x_refsource_REDHAT
RHSA-2026:54187 vendor-advisory, x_refsource_REDHAT
RHSA-2026:54553 vendor-advisory, x_refsource_REDHAT
RHSA-2026:54581 vendor-advisory, x_refsource_REDHAT
RHSA-2026:54599 vendor-advisory, x_refsource_REDHAT
RHSA-2026:54769 vendor-advisory, x_refsource_REDHAT
RHSA-2026:56786 vendor-advisory, x_refsource_REDHAT
RHSA-2026:56853 vendor-advisory, x_refsource_REDHAT
RHSA-2026:56911 vendor-advisory, x_refsource_REDHAT
RHSA-2026:57483 vendor-advisory, x_refsource_REDHAT
RHSA-2026:59831 vendor-advisory, x_refsource_REDHAT
RHSA-2026:60019 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-14474 vdb-entry, x_refsource_REDHAT
RHBZ#2496556 issue-tracking, x_refsource_REDHAT