CVE-2026-14476

CVE-2026-14476 · Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.

CVSS 8.0 · High · EPSS 0.7%

Published: 2026-07-07T09:12:52.180Z
Updated: 2026-10-08T22:44:29.546Z

Stack: system

Affected products and versions

red hat enterprise linux 10
Versions
- ≥ 0:2.12.0-3.el10_2.1: Not affected (rpm)
No fix published
red hat enterprise linux 10.0 extended update support
Versions
- ≥ 0:2.10.2-3.el10_0.5: Not affected (rpm)
No fix published
red hat enterprise linux 7 extended lifecycle support
Versions
- ≥ 0:1.16.5-10.el7_9.18: Not affected (rpm)
No fix published
red hat enterprise linux 8
Versions
- ≥ 0:2.9.4-5.el8_10.5: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 advanced mission critical update support
Versions
- ≥ 0:2.4.0-9.el8_4.5: Not affected (rpm)
No fix published
red hat enterprise linux 8.4 extended update support long-life add-on
Versions
- ≥ 0:2.4.0-9.el8_4.5: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 advanced mission critical update support
Versions
- ≥ 0:2.6.2-4.el8_6.5: Not affected (rpm)
No fix published
red hat enterprise linux 8.6 extended update support long-life add-on
Versions
- ≥ 0:2.6.2-4.el8_6.5: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 telecommunications update service
Versions
- ≥ 0:2.8.2-4.el8_8.4: Not affected (rpm)
No fix published
red hat enterprise linux 8.8 update services for sap solutions
Versions
- ≥ 0:2.8.2-4.el8_8.4: Not affected (rpm)
No fix published
red hat enterprise linux 9
Versions
- ≥ 0:2.9.8-4.el9_8.1: Not affected (rpm)
No fix published
red hat enterprise linux 9.2 update services for sap solutions
Versions
- ≥ 0:2.8.2-5.el9_2.7: Not affected (rpm)
No fix published
red hat enterprise linux 9.4 update services for sap solutions
Versions
- ≥ 0:2.9.4-6.el9_4.5: Not affected (rpm)
No fix published
red hat enterprise linux 9.6 extended update support
Versions
- ≥ 0:2.9.6-4.el9_6.5: Not affected (rpm)
No fix published
red hat openshift container platform 4.12
Versions
- ≥ 412.86.202608241157-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.13
Versions
- ≥ 413.92.202608111330-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.14
Versions
- ≥ 414.92.202608172040-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.15
Versions
- ≥ 415.92.202608180329-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.16
Versions
- ≥ 416.94.202608150307-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.17
Versions
- ≥ 417.94.202608250221-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.18
Versions
- ≥ 418.94.202608142238-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.19
Versions
- ≥ 4.19.9.6.202608120446-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.20
Versions
- ≥ 4.20.9.6.202608121719-0: Not affected (rpm)
No fix published
red hat openshift container platform 4.21
Versions
- ≥ 4.21.9.6.202608122143-0: Not affected (rpm)
No fix published

Original sources

Check your server →