CVE-2026-59681 yast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD join
Attackers controlling Active Directory configuration values can execute arbitrary commands as root on SUSE hosts via unsanitized inputs in the YaST auth client.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-59681?
CVE-2026-59681 is a high-severity command injection vulnerability in SUSE yast2-auth-client, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads testjoin invocations by interpolating configuration values into a single command string and passing that string to Open3.popen2 / Open3.capture2, which causes Ruby to run it through /bin/sh. The Organizational Unit (ou), dnshostname, AD user name and AD domain name values are neither validated nor shell-quoted.
Weakness: CWE-78
Which versions are affected by CVE-2026-59681?
Linux distribution packages (14)
yast2-auth-client SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 4.4.6-150400.3.19.1 |
yast2-auth-client SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 4.4.6-150400.3.19.1 |
yast2-auth-client SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 4.5.5-150500.3.9.1 |
yast2-auth-client SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 4.5.5-150500.3.9.1 |
yast2-auth-client SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 4.7.1-150700.3.9.1 |
yast2-auth-client SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 3.3.22-3.15.1 |
yast2-auth-client SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 4.4.6-150400.3.19.1 |
yast2-auth-client SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 4.5.5-150500.3.9.1 |
yast2-auth-client SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 4.6.3-150600.3.12.1 |
yast2-auth-client SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.3.22-3.15.1 |
yast2-auth-client SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 4.4.6-150400.3.19.1 |
yast2-auth-client SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 4.5.5-150500.3.9.1 |
yast2-auth-client SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 4.6.3-150600.3.12.1 |
yast2-auth-client openSUSE:Tumbleweed | All versions | 5.0.5-1.1 |
How do I fix CVE-2026-59681?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-59681 being exploited?
There is no known exploitation of CVE-2026-59681 in the wild and no public exploit code.
Sources
Also known as GHSA-hhmf-6c6g-6xc3, SUSE-SU-2026:3893-1, SUSE-SU-2026:3894-1, SUSE-SU-2026:3895-1, SUSE-SU-2026:3901-1, SUSE-SU-2026:3914-1 and 1 more.