CVE-2026-14476: SSSD AD GPO Path Traversal & Authentication Bypass

Technical summary

The ad_gpo_extract_smb_components() function in SSSD's AD GPO provider fails to sanitize directory traversal sequences (..) within the gPCFileSysPath LDAP attribute. This allows an authenticated attacker with GPO management access to construct a malicious LDAP attribute value that, when processed, writes arbitrary files to locations outside the GPO cache directory with root-level privileges. The vulnerability is particularly serious in default RHEL configurations where SELinux enforcing policies may not restrict file writes to Kerberos configuration paths, enabling authentication policy injection attacks.

Business impact

Organizations using SSSD for AD integration face a privilege escalation and authentication bypass risk. An attacker with GPO management rights—potentially a domain administrator or compromised admin account—could inject malicious Kerberos configuration to intercept or forge authentication tokens, leading to unauthorized access to enterprise resources. This undermines the security boundary between AD administrators and system-level access controls, particularly in environments where SELinux is configured in enforcing mode.

Affected systems

SSSD (System Security Services Daemon) installations configured to use Active Directory GPO provider are affected. The vulnerability impacts systems on RHEL (and related distributions) that consume GPO settings via SSSD's AD integration, especially those with SELinux enforcing policies. Organizations should verify SSSD version and GPO provider configuration to determine exposure.

Exploitability

Exploitation requires authentication as an AD principal with GPO management or modification rights—typically domain administrator or delegated GPO editor accounts. Network access to SSSD and the AD domain is required. The attack does not require user interaction or unusual configuration; default RHEL deployments with SELinux may be exploitable if the Kerberos configuration directories are not additionally hardened. CVSS score of 8.0 (HIGH) reflects high impact (authentication bypass) but limited attack surface (requires high-privilege AD account).

Remediation

Apply security updates from Red Hat that patch the ad_gpo_extract_smb_components() function to properly sanitize directory traversal sequences in the gPCFileSysPath attribute. Simultaneously, organizations should audit GPO management role assignments in Active Directory, restricting this privilege to trusted administrators only. As a defense-in-depth measure, verify that Kerberos configuration directories (/etc/krb5.conf, /etc/krb5.conf.d/) are owned by root and have restricted file permissions (644 or more restrictive) to limit the impact of unauthorized writes.

Patch guidance

Monitor Red Hat security advisories for SSSD package updates addressing CVE-2026-14476. Once patches are released, apply them to all affected SSSD deployments through your standard patch management process. Test patches in a non-production environment first to ensure compatibility with existing AD GPO and Kerberos configurations. Verify that the patched version properly rejects or sanitizes .. sequences in LDAP attributes before applying to production systems.

Detection guidance

Monitor SSSD logs (typically in /var/log/sssd/) for errors or unusual behavior during GPO processing, particularly warnings related to path handling or file writes. Audit file system activity on Kerberos configuration directories (/etc/krb5.conf and related paths) for unexpected modifications, especially changes originating from SSSD processes. Use SELinux audit logs to detect policy violations or denials related to GPO cache operations. Implement file integrity monitoring on critical authentication configuration files to alert on unauthorized changes.

Why prioritize this

This vulnerability merits prompt remediation because it enables authentication bypass in AD-integrated environments—a critical trust boundary violation. The attacker profile (AD administrator or delegated GPO manager) is realistic in many enterprises, and the impact (Kerberos configuration injection) directly compromises authentication integrity. While the CVE is not yet on the CISA KEV catalog, the combination of high impact, default-configuration exploitability, and authentication-layer targeting makes it a priority for organizations relying on SSSD for centralized authentication.

Risk score, explained

The CVSS 3.1 score of 8.0 (HIGH) reflects: high confidentiality and integrity impact (authentication bypass, file write as root), high availability risk (potential denial of service via configuration corruption), network-adjacent attack vector (requires AD connectivity), and high privilege requirement (AD GPO management rights). The score appropriately captures the severity while acknowledging that exploitation is limited to privileged AD accounts rather than arbitrary network users. The complexity (AC:H) acknowledges that successful exploitation requires specific GPO attribute crafting and SELinux configuration state.

Frequently asked questions