CVE-2026-14476 Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass
An attacker with AD GPO management access can exploit a path traversal flaw in SSSD to write files as root, potentially bypassing Kerberos authentication.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14476?
CVE-2026-14476 is a high-severity path traversal vulnerability in Red Hat Enterprise Linux 10, published on 7 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.
Weakness: CWE-23
Which versions are affected by CVE-2026-14476?
How do I fix CVE-2026-14476?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-14476 being exploited?
There is no known exploitation of CVE-2026-14476 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-14476, GHSA-v6qh-pm8g-3c5w, OESA-2026-3147, OESA-2026-3148, UBUNTU-CVE-2026-14476.