This important update for SSSD addresses two high-severity vulnerabilities: CVE-2026-14474 (CVSS 8.8) allows privilege escalation via the sudo LDAP provider's default search of the entire directory tree for sudoRole objects, and CVE-2026-14476 (CVSS 8.0) enables Kerberos authentication bypass via a GPO cache path traversal through an unsanitized `gPCFileSysPath`. The advisory applies to Red Hat Enterprise Linux 9 and its Extended Update Support variants; affected systems should apply the referenced security update immediately via the provided Red Hat solution article.
Red Hat Product Errata RHSA-2026:42122 - Security Advisory Issued: 2026-07-20 Updated: 2026-07-20 RHSA-2026:42122 - Security Advisory Overview Updated Packages Synopsis Important: sssd security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for sssd is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat CodeReady Linux Builder for x86_64 9 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le Red Hat CodeReady Linux Builder for ARM 64 9 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2496556 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation BZ - 2496581 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass CVEs CVE-2026-14474 CVE-2026-14476 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM sssd-2.9.8-4.el9_8.1.src.rpm SHA-256: 462a77f9102795574ffb19a0311bbe4c7a876bd17ac3d8dc989cb43dd9ab5ea0 x86_64 libipa_hbac-2.9.8-4.el9_8.1.i686.rpm SHA-256: cf37dcaa33eba38af3bff1a89c527733e616e749a544bdba9fca9bd22ddd7de3 libipa_hbac-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: e659a151c460db93f61423f41dd1fc8a67060bcf59aee19fad9b75637f904afb libsss_autofs-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 9207e742f9d46b4b36154f3f62b781c2a581e12c7ac50214f8704d98e6088cba libsss_certmap-2.9.8-4.el9_8.1.i686.rpm SHA-256: 6b1e2e3fb2da642ca1bf1f0911e34f892e381bdc2ef3f45b40a3a86ec238f782 libsss_certmap-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 80913fdc697316189f07bcabc7522ad5eeb34fc4d92936a727535936ea033537 libsss_idmap-2.9.8-4.el9_8.1.i686.rpm SHA-256: 9c940a122549d389999f0bd63ea2be008a2e6b01b2014e5ced08b418c2391134 libsss_idmap-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 1ff949e5cd0e4e9fb939be614b957c9fd5c34c26b5c242e39ff46cf9af02a2ed libsss_nss_idmap-2.9.8-4.el9_8.1.i686.rpm SHA-256: 44f29b030540a1600242a037f0ee5925530ceadd7da10f9928a93c69e3f4c607 libsss_nss_idmap-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: f5aa37726c990120147bf584946f1ecc75527675da5ee8d1198209933133aa22 libsss_simpleifp-2.9.8-4.el9_8.1.i686.rpm SHA-256: 34a17a3fb7b32a9ff558f4b047747cd3d0b4795e2d0c8d07343a41dc8baaf27b libsss_simpleifp-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: c607d7c2369b92c6f277169807d1b6b2b4d2507d75dbaf23d56339f67d7f060d libsss_sudo-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: dfe52afa09201c95f0495be0fcdb5bdb1e775498109c9cd9fed4c47865c3e9b1 python3-libipa_hbac-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: cfbad74bf26d9874a9823e569a30293cce1146804511dc02c9beee9db580cd1c python3-libsss_nss_idmap-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 15d78b583fea6e0d0872fc5e6d1f7258a724a044b2ecfb2191c8ea756177aa4a python3-sss-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 6af8e33458855d0d305937037230f59e2d18de89ebce1645f3529278008382ca python3-sss-murmur-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: ceb51c872a1bc8760e9a001109de852293f982ad4eef34ea1793b892ac331f97 python3-sssdconfig-2.9.8-4.el9_8.1.noarch.rpm SHA-256: 953d996d0e6473ca795ba7d6df4871c5b98d4c07359b588d7afa3935ebc06c8c sssd-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 0167be13837e593588171d487cc807caf78f95880d7417eec745d53f2fa84d23 sssd-ad-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: e6f742996b1d58355bd69b219f789a154fbb62b2ba99d257eb2abe0af5e5137b sssd-client-2.9.8-4.el9_8.1.i686.rpm SHA-256: 6a959693d3508d98b188fc96b135695df7dc2f1b412ba361f3a9a76997c3ae44 sssd-client-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: ad0fa4a27e6673bfe9a0ac24d1d2065207b015c7d7499d6f46e51f301aa85e94 sssd-common-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 510ab61c8d8e25a7ce2d38cafe01461279cac5ac06a482407c8377b4c84c00f0 sssd-common-pac-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: b97824f07b7a6da4448694063e7be3134652ac4d7f38c5b6f35b85ffe1d6a07e sssd-dbus-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 4cebe8aefb96047abc6a38aef352f4894a05b92dae9fab88268cf1ce54766ad5 sssd-ipa-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 56c5cad3ebfff95569f270b7333c2d7b67ecd8a85de86385bb5d338717447027 sssd-kcm-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 9ef019be9b7b4a29feca7a2c433274057061b64158ca79c4055b63b62aa044e3 sssd-krb5-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 620250b04d184e3caa4fd2bd728ee031e9d7cad855165500bd6da8bd9844f9fe sssd-krb5-common-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 7b472df936df9879babc3b2d51bd8de37f6aa52055b1ca8420fcc18bf9f9b505 sssd-ldap-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 92bea31c672716027e5fdb2f60e7454a8536dbc0f0306c1ae798a18a9abb9d2f sssd-nfs-idmap-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 8de64b293843f1ad6c14ee4972a1b304b855cb7116835a35e23fc0b53ae5917c Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 SRPM sssd-2.9.8-4.el9_8.1.src.rpm SHA-256: 462a77f9102795574ffb19a0311bbe4c7a876bd17ac3d8dc989cb43dd9ab5ea0 x86_64 libipa_hbac-2.9.8-4.el9_8.1.i686.rpm SHA-256: cf37dcaa33eba38af3bff1a89c527733e616e749a544bdba9fca9bd22ddd7de3 libipa_hbac-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: e659a151c460db93f61423f41dd1fc8a67060bcf59aee19fad9b75637f904afb libsss_autofs-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 9207e742f9d46b4b36154f3f62b781c2a581e12c7ac50214f8704d98e6088cba libsss_certmap-2.9.8-4.el9_8.1.i686.rpm SHA-256: 6b1e2e3fb2da642ca1bf1f0911e34f892e381bdc2ef3f45b40a3a86ec238f782 libsss_certmap-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 80913fdc697316189f07bcabc7522ad5eeb34fc4d92936a727535936ea033537 libsss_idmap-2.9.8-4.el9_8.1.i686.rpm SHA-256: 9c940a122549d389999f0bd63ea2be008a2e6b01b2014e5ced08b418c2391134 libsss_idmap-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 1ff949e5cd0e4e9fb939be614b957c9fd5c34c26b5c242e39ff46cf9af02a2ed libsss_nss_idmap-2.9.8-4.el9_8.1.i686.rpm SHA-256: 44f29b030540a1600242a037f0ee5925530ceadd7da10f9928a93c69e3f4c607 libsss_nss_idmap-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: f5aa37726c990120147bf584946f1ecc75527675da5ee8d1198209933133aa22 libsss_simpleifp-2.9.8-4.el9_8.1.i686.rpm SHA-256: 34a17a3fb7b32a9ff558f4b047747cd3d0b4795e2d0c8d07343a41dc8baaf27b libsss_simpleifp-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: c607d7c2369b92c6f277169807d1b6b2b4d2507d75dbaf23d56339f67d7f060d libsss_sudo-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: dfe52afa09201c95f0495be0fcdb5bdb1e775498109c9cd9fed4c47865c3e9b1 python3-libipa_hbac-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: cfbad74bf26d9874a9823e569a30293cce1146804511dc02c9beee9db580cd1c python3-libsss_nss_idmap-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 15d78b583fea6e0d0872fc5e6d1f7258a724a044b2ecfb2191c8ea756177aa4a python3-sss-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 6af8e33458855d0d305937037230f59e2d18de89ebce1645f3529278008382ca python3-sss-murmur-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: ceb51c872a1bc8760e9a001109de852293f982ad4eef34ea1793b892ac331f97 python3-sssdconfig-2.9.8-4.el9_8.1.noarch.rpm SHA-256: 953d996d0e6473ca795ba7d6df4871c5b98d4c07359b588d7afa3935ebc06c8c sssd-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: 0167be13837e593588171d487cc807caf78f95880d7417eec745d53f2fa84d23 sssd-ad-2.9.8-4.el9_8.1.x86_64.rpm SHA-256: e6f742996b1d58355bd69b219f789a154fbb62b2ba99d257eb2abe0af5e5137b sssd-client-2.9.8-4.el9_8.1.i686.rpm SHA-256: 6a959693d3508d98b188fc96b135695df7dc2f1b412ba361f3a9a76997c3ae44