Critical Security Flaw in SSSD Packages: Privilege Escalation and Authentication Bypass
Summary
ALSA-2026:41937: Important: sssd security update. Affects libipa_hbac versions < 2.12.0-3.el10_2.1. Fixed in 2.12.0-3.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The System Security Services Daemon (SSSD) is a crucial service that manages access to remote directories and authentication mechanisms. It provides interfaces for Name Service Switch (NSS) and Pluggable Authentication Modules (PAM), allowing seamless integration with various account sources. This vulnerability affects multiple SSSD-related packages in AlmaLinux 10, potentially compromising system security.
Vulnerability Detail
The vulnerability arises from two critical issues within the SSSD service. Firstly, the sudo LDAP provider searches the entire directory tree for sudoRole objects by default, which can lead to privilege escalation (CVE-2026-14474). Secondly, a GPO cache path traversal via an unsanitized gPCFileSysPath allows for Kerberos authentication bypass (CVE-2026-14476). These vulnerabilities can be exploited by malicious actors to gain unauthorized access and escalate privileges within the system.
How To Fix
Minimum fixed version
2.12.0-3.el10_2.1
This is the first release that contains the fix.
sudo dnf update libipa_hbacTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can restrict access to the LDAP provider or implement additional access controls to mitigate the risk of privilege escalation and authentication bypass until the patch is applied.
Conclusion
In summary, the SSSD security update addresses critical vulnerabilities that could lead to privilege escalation and authentication bypass. It is essential to update the affected packages promptly to safeguard your system against potential exploits.
See every vulnerability recorded for libipa_hbac →
FAQ
SSSD stands for System Security Services Daemon, which manages access to remote directories and authentication mechanisms.
Exploitation of this vulnerability can lead to privilege escalation and unauthorized access to sensitive system resources.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Implement access controls or restrict access to the LDAP provider as a temporary workaround until the update can be applied.
For detailed information, refer to the CVE pages: CVE-2026-14474 and CVE-2026-14476.
Related vulnerabilities
Recent vulnerabilities recorded for libipa_hbac.
