Vulnerability · Published Jul 7, 2026 · Assigned by redhat

CVE-2026-14476Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

High 8.0

In plain English

A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.7%top 47.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:10	libipa_hbac	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libipa_hbac	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libipa_hbac	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	libsss_autofs	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libsss_autofs	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libsss_autofs	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	libsss_certmap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libsss_certmap	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libsss_certmap	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	libsss_idmap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libsss_idmap	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libsss_idmap	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	libsss_nss_idmap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libsss_nss_idmap	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libsss_nss_idmap	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	libsss_nss_idmap-devel	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libsss_nss_idmap-devel	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:8	libsss_simpleifp	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libsss_simpleifp	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	libsss_sudo	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	libsss_sudo	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	libsss_sudo	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	python3-libipa_hbac	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	python3-libipa_hbac	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	python3-libipa_hbac	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	python3-libsss_nss_idmap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	python3-libsss_nss_idmap	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	python3-libsss_nss_idmap	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	python3-sss	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	python3-sss	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	python3-sss	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	python3-sss-murmur	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	python3-sss-murmur	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	python3-sss-murmur	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	python3-sssdconfig	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	python3-sssdconfig	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	python3-sssdconfig	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-ad	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-ad	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-ad	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-client	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-client	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-client	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-common	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-common	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-common	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-common-pac	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-common-pac	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-common-pac	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-dbus	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-dbus	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-dbus	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-idp	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-idp	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:10	sssd-ipa	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-ipa	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-ipa	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-kcm	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-kcm	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-kcm	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-krb5	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-krb5	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-krb5	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-krb5-common	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-krb5-common	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-krb5-common	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-ldap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-ldap	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-ldap	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-nfs-idmap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-nfs-idmap	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-nfs-idmap	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-passkey	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-polkit-rules	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:10	sssd-proxy	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-proxy	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:9	sssd-proxy	2.9.8-4.el9_8.1	ALSA-2026:42122
AlmaLinux:10	sssd-tools	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-tools	2.9.4-5.el8_10.5	ALSA-2026:46990
AlmaLinux:10	sssd-winbind-idmap	2.12.0-3.el10_2.1	ALSA-2026:41937
AlmaLinux:8	sssd-winbind-idmap	2.9.4-5.el8_10.5	ALSA-2026:46990
Debian:12	sssd	no fix listed	DEBIAN-CVE-2026-14476
Debian:13	sssd	no fix listed	DEBIAN-CVE-2026-14476
Rocky Linux:10	sssd	0:2.12.0-3.el10_2.1	RLSA-2026:41937
Rocky Linux:8	sssd	0:2.9.4-5.el8_10.5	RLSA-2026:46990
Rocky Linux:9	sssd	0:2.9.8-4.el9_8.1	RLSA-2026:42122
Ubuntu:22.04:LTS	sssd	no fix listed	UBUNTU-CVE-2026-14476
Ubuntu:24.04:LTS	sssd	no fix listed	UBUNTU-CVE-2026-14476
Ubuntu:25.10	sssd	no fix listed	UBUNTU-CVE-2026-14476
Ubuntu:26.04:LTS	sssd	no fix listed	UBUNTU-CVE-2026-14476
Ubuntu:26.10	sssd	no fix listed	UBUNTU-CVE-2026-14476

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	see references
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	see references
Red Hat	Red Hat OpenShift Container Platform 4.12	see references
Red Hat	Red Hat OpenShift Container Platform 4.13	see references
Red Hat	Red Hat OpenShift Container Platform 4.14	see references
Red Hat	Red Hat OpenShift Container Platform 4.15	see references
Red Hat	Red Hat OpenShift Container Platform 4.16	see references
Red Hat	Red Hat OpenShift Container Platform 4.17	see references
Red Hat	Red Hat OpenShift Container Platform 4.18	see references
Red Hat	Red Hat OpenShift Container Platform 4.19	see references
Red Hat	Red Hat OpenShift Container Platform 4.20	see references
Red Hat	Red Hat OpenShift Container Platform 4.21	see references
Red Hat	Red Hat OpenShift Container Platform 4.22	see references
Red Hat	Red Hat Enterprise Linux 6	see references
Red Hat	Red Hat OpenShift Container Platform 5	see references

Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References

RHSA-2026:41937 vendor-advisory, x_refsource_REDHAT
RHSA-2026:42122 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46482 vendor-advisory, x_refsource_REDHAT
RHSA-2026:46990 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49839 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49840 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49841 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49842 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49843 vendor-advisory, x_refsource_REDHAT
RHSA-2026:49844 vendor-advisory, x_refsource_REDHAT
RHSA-2026:50109 vendor-advisory, x_refsource_REDHAT
RHSA-2026:54187 vendor-advisory, x_refsource_REDHAT
RHSA-2026:54553 vendor-advisory, x_refsource_REDHAT
RHSA-2026:54581 vendor-advisory, x_refsource_REDHAT
RHSA-2026:54599 vendor-advisory, x_refsource_REDHAT
RHSA-2026:54769 vendor-advisory, x_refsource_REDHAT
RHSA-2026:56786 vendor-advisory, x_refsource_REDHAT
RHSA-2026:56853 vendor-advisory, x_refsource_REDHAT
RHSA-2026:56911 vendor-advisory, x_refsource_REDHAT
RHSA-2026:57483 vendor-advisory, x_refsource_REDHAT
RHSA-2026:59831 vendor-advisory, x_refsource_REDHAT
RHSA-2026:60019 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-14476 vdb-entry, x_refsource_REDHAT
RHBZ#2496581 issue-tracking, x_refsource_REDHAT