CVE-2026-14476: Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass
A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.
Other sources
The adgpoextractsmbcomponents() function in SSSD's AD GPO provider converts backslashes to forward slashes in the gPCFileSysPath LDAP attribute but does not sanitize .. path components. A differential between libsmbclient's path clamping (resolves .. at the share root) and the kernel's path resolution (resolves .. fully) allows an attacker with AD GPO management access to write files outside the GPO cache directory as root.
On SELinux-enforcing systems (the default on RHEL), the traversal can target /var/lib/sss/pubconf/krb5.include.d/ (labeled sssdpublict), enabling Kerberos KDC redirection and authentication bypass. On SELinux-permissive or disabled systems, arbitrary file write as root is possible.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14476?
The severity of CVE-2026-14476 is rated as high with a score of 8.
How do I fix CVE-2026-14476?
To fix CVE-2026-14476, update to the latest version of Red Hat SSSD that addresses this vulnerability.
What is the impact of CVE-2026-14476?
CVE-2026-14476 allows an attacker with AD GPO management access to perform path traversal and potentially write files outside the GPO cache as root.
Is CVE-2026-14476 exploitable remotely?
Yes, CVE-2026-14476 is exploitable remotely if the attacker has AD GPO management access.
What systems are affected by CVE-2026-14476?
CVE-2026-14476 affects systems running Red Hat SSSD with the vulnerable configuration.