CVE-2026-14474: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-14474 is a privilege escalation vulnerability in SSSD's (System Security Services Daemon) LDAP sudo provider, classified as an insecure default initialization flaw. When the ldap_sudo_search_base option is not explicitly configured — the default behavior — SSSD falls back to the domain's root DN and searches the entire LDAP directory tree for sudoRole objects using SUBTREE scope. An authenticated attacker with write access to any LDAP subtree can inject a malicious sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts. The vulnerability affects sudo_provider = ldap and sudo_provider = ad configurations; sudo_provider = ipa is NOT affected. It was disclosed on July 7, 2026, with patches released on July 20, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-1188 (Initialization of a Resource with an Insecure Default). When ldap_sudo_search_base is left unconfigured, SSSD's sdap_sudo_init() function defaults to searching the entire LDAP directory tree from the root DN, rather than a restricted, administrator-controlled subtree. An attacker with LDAP write access to any subtree — even a low-privilege organizational unit — can create a sudoRole object with attributes such as sudoUser: ALL, sudoHost: ALL, and sudoCommand: ALL, which SSSD will then discover and apply to all enrolled hosts. The attack vector is network-based, requires low privileges (authenticated LDAP access), and no user interaction (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows an authenticated attacker to grant themselves or any user root-level sudo privileges across every host enrolled in SSSD using the affected LDAP or AD sudo provider. This results in complete compromise of confidentiality, integrity, and availability on all affected systems, as the attacker can execute arbitrary commands as root. The blast radius is particularly severe in enterprise environments where SSSD manages authentication for large numbers of Linux hosts centrally via LDAP or Active Directory (Red Hat Bugzilla, GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.348% (27th percentile), indicating a currently low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack is conceptually straightforward for any authenticated LDAP user with write access to any subtree, making it a significant risk in environments with broad LDAP write permissions.

1. Reconnaissance: Identify SSSD-enrolled Linux hosts in the target environment and confirm they use sudo_provider = ldap or sudo_provider = ad without an explicitly configured ldap_sudo_search_base in /etc/sssd/sssd.conf.
2. Obtain LDAP write access: Authenticate to the LDAP directory with any account that has write access to at least one subtree (e.g., a personal user OU or any writable organizational unit).
3. Craft malicious sudoRole object: Using an LDAP client tool (e.g., ldapadd or Apache Directory Studio), create a new LDAP entry with objectClass: sudoRole in any writable subtree. Set attributes: sudoUser: ALL, sudoHost: ALL, sudoCommand: ALL, and optionally sudoRunAsUser: root.
4. Wait for SSSD cache refresh: SSSD periodically polls LDAP for sudoRole objects across the entire directory tree. After the cache refresh interval (default: typically 6 hours, or force with sss_cache -G), the injected sudoRole will be picked up.
5. Escalate privileges: On any SSSD-enrolled host, run sudo -l to confirm the injected rule is active, then execute sudo su - or any privileged command to achieve root access (Red Hat Bugzilla, GitHub Advisory).

• LDAP Directory: Unexpected sudoRole objects appearing in non-standard LDAP subtrees (outside the designated sudo OU); entries with sudoUser: ALL, sudoHost: ALL, or sudoCommand: ALL in unusual locations.
• Logs: SSSD logs (/var/log/sssd/sssd_sudo.log) showing sudoRole objects retrieved from unexpected LDAP DNs outside the intended sudo search base; entries referencing subtrees not normally associated with sudo policy.
• System: Unexpected entries in sudo -l output for users, particularly broad rules not matching organizational policy; sss_cache invocations or SSSD restarts not initiated by administrators.
• Process/Auth: Unusual sudo executions by accounts not normally granted elevated privileges, visible in /var/log/secure or /var/log/auth.log with sudo entries for unexpected users or commands.

Red Hat has released patched packages addressing this vulnerability: for RHEL 10, update to sssd-2.12.0-3.el10_2.1 (via RHSA-2026:41937); for RHEL 9, update to sssd-2.9.8-4.el9_8.1 (via RHSA-2026:42122). SUSE has also released updates (SUSE-SU-2026:3131-1 and SUSE-SU-2026:3139-1), and Amazon Linux 2023 has issued ALAS2023-2026-1984. As an immediate workaround prior to patching, explicitly configure ldap_sudo_search_base in /etc/sssd/sssd.conf to restrict sudo role searches to a specific, protected LDAP subtree (e.g., ldap_sudo_search_base = ou=sudoers,dc=example,dc=com). Additionally, review and restrict LDAP write access controls to prevent unauthorized users from creating sudoRole objects in any subtree (Red Hat RHSA-2026:41937, Red Hat RHSA-2026:42122).

Red Hat rated this vulnerability as Important severity and issued security advisories for both RHEL 9 and RHEL 10 on July 20, 2026 (Red Hat RHSA-2026:41937, Red Hat RHSA-2026:42122). SUSE and openSUSE also issued security updates, and the vulnerability received coverage in Linux security news outlets including pro-linux.de and linuxcompatible.org. Community discussion noted on Mastodon (infosec.exchange) highlighted the broad impact on enterprise Linux environments using centralized LDAP-based sudo management.