CVE-2026-14476: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-14476 is a relative path traversal vulnerability (CWE-23) in SSSD's Active Directory Group Policy Object (GPO) provider, enabling an attacker with AD GPO management access to write arbitrary files outside the GPO cache directory as root. The flaw was disclosed on July 7, 2026, and affects SSSD as shipped with Red Hat Enterprise Linux 9 and 10, as well as SUSE and Amazon Linux 2023. Fixed versions include sssd-2.9.8-4.el9_8.1 (RHEL 9) and sssd-2.12.0-3.el10_2.1 (RHEL 10). It carries a CVSS v3.1 base score of 8.0 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is in the ad_gpo_extract_smb_components() function within SSSD's AD GPO provider, which converts backslashes to forward slashes in the gPCFileSysPath LDAP attribute but fails to sanitize .. (dot-dot) path sequences (CWE-23: Relative Path Traversal). A behavioral discrepancy between libsmbclient's path clamping (which resolves .. at the SMB share root) and the Linux kernel's path resolution (which resolves .. fully) allows the traversal to escape the GPO cache directory. On SELinux-enforcing systems (the default on RHEL), the traversal can target /var/lib/sss/pubconf/krb5.include.d/ (labeled sssd_public_t), enabling injection of a malicious Kerberos configuration file. On SELinux-permissive or disabled systems, arbitrary file write as root is possible (Red Hat Bugzilla, Github Advisory).

Successful exploitation allows an attacker with AD GPO management privileges to write files outside the intended GPO cache directory as the root user. On default RHEL configurations with SELinux enforcing, the primary impact is Kerberos KDC redirection and authentication bypass, which could allow the attacker to impersonate users or gain unauthorized access to systems relying on Kerberos authentication. On systems with SELinux disabled or in permissive mode, the impact escalates to arbitrary file write as root, potentially enabling full system compromise, persistence, or lateral movement across the AD-integrated environment (Red Hat Bugzilla, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires the attacker to already hold high-privilege AD GPO management access, significantly limiting the attack surface. The EPSS score is approximately 0.69%, indicating a low near-term probability of exploitation (Github Advisory). NVD's SSVC assessment classifies exploitation as "none" and the attack as non-automatable.

1. Obtain AD GPO Management Access: The attacker must first acquire Active Directory credentials with GPO management privileges (e.g., via credential theft, phishing, or insider access) for the target domain.
2. Craft a Malicious GPO: Using AD management tools (e.g., gpmc.msc or PowerShell), create or modify a GPO and set the gPCFileSysPath LDAP attribute to a path containing .. sequences (e.g., \\dc.example.com\sysvol\..\..\..\var\lib\sss\pubconf\krb5.include.d\evil.conf).
3. Trigger SSSD GPO Processing: Wait for or force a target Linux host (joined to the AD domain and running SSSD with the AD GPO provider enabled) to refresh its GPO cache, causing ad_gpo_extract_smb_components() to process the malicious gPCFileSysPath.
4. Exploit Path Traversal: SSSD resolves the .. sequences via the kernel's path resolution, writing attacker-controlled content to a location outside the GPO cache directory — on SELinux-enforcing RHEL, targeting /var/lib/sss/pubconf/krb5.include.d/.
5. Inject Kerberos Configuration: The written file injects a malicious Kerberos configuration (e.g., redirecting KDC to an attacker-controlled server), enabling authentication bypass or credential interception on the affected Linux host (Red Hat Bugzilla, Github Advisory).

• File System: Unexpected or newly created files in /var/lib/sss/pubconf/krb5.include.d/ not corresponding to legitimate GPO configurations; files in the SSSD GPO cache directory (/var/lib/sss/db/) with unusual path components containing .. sequences.
• Logs: SSSD log entries (typically in /var/log/sssd/) referencing unusual gPCFileSysPath values containing .. or paths outside the expected GPO share structure; Kerberos authentication failures or redirections logged in /var/log/krb5libs.log or /var/log/secure.
• Network: SMB connections from the Linux host to unexpected file shares or domain controllers not matching the configured AD environment; Kerberos TGT/TGS requests directed to non-standard KDC addresses.
• Process: Unexpected SSSD process activity during GPO refresh cycles; sssd_be process writing files to directories outside /var/lib/sss/db/.

Red Hat has released patched packages addressing this vulnerability: sssd-2.9.8-4.el9_8.1 for RHEL 9 (via RHSA-2026:42122) and sssd-2.12.0-3.el10_2.1 for RHEL 10 (via RHSA-2026:41937). SUSE has also released fixes (SUSE-SU-2026:3131-1 and SUSE-SU-2026:3139-1), and Amazon Linux 2023 has issued ALAS2023-2026-1984. As a workaround, restrict AD GPO management access strictly to trusted administrators to reduce the risk of a compromised account being used for exploitation. Keeping SELinux in enforcing mode limits the impact to Kerberos configuration injection rather than arbitrary file write as root (Red Hat Bugzilla, Github Advisory).

Red Hat rated this vulnerability as Important severity and issued security advisories for both RHEL 9 and RHEL 10 on July 20, 2026 (RHSA-2026:41937, RHSA-2026:42122). SUSE and Amazon Linux also responded promptly with their own patches. The vulnerability was tracked by multiple security scanner vendors including Tenable (Nessus) and Qualys, with detection plugins published shortly after disclosure. No significant independent researcher commentary or broad social media discussion has been identified beyond standard vulnerability database aggregation.