CVE-2026-14474: Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
Other sources
When ldapsudosearchbase is not explicitly configured (the default), SSSD falls back to the domain's root DN and searches the entire LDAP directory tree for objects matching (objectClass=sudoRole) with SUBTREE scope. Any LDAP principal with write access to any subtree can create a sudoRole object granting arbitrary sudo privileges on every SSSD-enrolled host.
This affects sudoprovider = ldap and sudoprovider = ad (which delegates to sdapsudoinit()). sudoprovider = ipa is NOT affected.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set ldap_sudo_search_base explicitly (instead of leaving the default) so SSSD does not search the domain root DN/subtree for (objectClass=sudoRole); limit the search to the DN that contains only the sudoRole objects you intend to grant privileges.
SSSD (sudo ldap provider / sdap_sudo_init) ldap_sudo_search_base = configured to a specific base DN - Compensating control
If sudo_provider is set to ldap (or sudo_provider=ad, which delegates to sdap_sudo_init()), restrict LDAP write access so only trusted principals can create/modify sudoRole objects in the LDAP subtree that ldap_sudo_search_base points to.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14474?
CVE-2026-14474 has a severity rating of high, with a score of 8.8.
What impact does CVE-2026-14474 have?
CVE-2026-14474 allows an authenticated attacker with write access to a subtree to inject a sudoRole object, potentially granting root-level sudo privileges.
How do I fix CVE-2026-14474?
To fix CVE-2026-14474, explicitly configure the ldap_sudo_search_base option in the SSSD configuration to limit the search scope for sudoRole objects.
What software is affected by CVE-2026-14474?
CVE-2026-14474 affects the SSSD software specifically when using the sudo LDAP provider.
Who is vulnerable to CVE-2026-14474?
Organizations using the SSSD LDAP sudo provider without explicit configuration are vulnerable to CVE-2026-14474.