Critical Security Flaw in SSSD Packages: Privilege Escalation and Authentication Bypass
Summary
ALSA-2026:42122: Important: sssd security update. Affects libipa_hbac versions < 2.9.8-4.el9_8.1. Fixed in 2.9.8-4.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The System Security Services Daemon (SSSD) is a crucial service that manages access to remote directories and authentication mechanisms. It provides interfaces for Name Service Switch (NSS) and Pluggable Authentication Modules (PAM), allowing seamless integration with various account sources. This service is vital for organizations relying on centralized authentication and directory services.
Vulnerability Detail
The vulnerability arises from two significant issues within the SSSD packages. Firstly, the sudo LDAP provider's default behavior of searching the entire directory tree for sudoRole objects can lead to privilege escalation (CVE-2026-14474). Secondly, a path traversal vulnerability in the GPO cache via an unsanitized gPCFileSysPath allows attackers to bypass Kerberos authentication (CVE-2026-14476). These vulnerabilities can have severe ramifications, including unauthorized access and elevated privileges, compromising the security of the entire system.
How To Fix
Minimum fixed version
2.9.8-4.el9_8.1
This is the first release that contains the fix.
sudo dnf update libipa_hbacTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the affected services or disable the sudo LDAP provider until the patch is applied. This can be done by modifying the SSSD configuration file, typically located at /etc/sssd/sssd.conf, to limit the scope of LDAP searches.
Conclusion
In summary, the vulnerabilities in the SSSD packages pose significant security risks, including privilege escalation and authentication bypass. It is crucial to update the affected packages to the patched version to mitigate these risks effectively.
See every vulnerability recorded for libipa_hbac →
FAQ
SSSD stands for System Security Services Daemon, which manages access to remote directories and authentication mechanisms.
The vulnerabilities can lead to privilege escalation and authentication bypass, allowing unauthorized access to sensitive resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider implementing temporary workarounds such as restricting access to the affected services until the update can be applied.
For detailed information, refer to the CVE pages: CVE-2026-14474 and CVE-2026-14476.
Related vulnerabilities
Recent vulnerabilities recorded for libipa_hbac.
