CVE-2026-14474: SSSD LDAP Privilege Escalation Flaw

CVE-2026-14474 Overview

CVE-2026-14474 is a privilege escalation flaw in the System Security Services Daemon (SSSD) Lightweight Directory Access Protocol (LDAP) sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a rogue sudoRole object. That object grants root-level sudo privileges on every SSSD-enrolled host across the environment.

The issue is tracked as an initialization of a resource with an insecure default [CWE-1188]. Red Hat has published an advisory for the flaw.

Critical Impact
A single authenticated LDAP writer can escalate to root across all SSSD-enrolled Linux hosts by injecting a sudoRole object into any writable subtree.

Affected Products

SSSD LDAP sudo provider deployments where ldap_sudo_search_base is not explicitly configured
Red Hat Enterprise Linux systems using SSSD for sudo rules via LDAP
Any Linux distribution integrating SSSD with a shared LDAP directory

Discovery Timeline

2026-07-07 - CVE-2026-14474 published to the National Vulnerability Database
2026-07-07 - Last updated in the NVD database

Technical Details for CVE-2026-14474

Vulnerability Analysis

SSSD provides centralized identity and policy management for Linux hosts. Its LDAP sudo provider fetches sudoRole objects from a directory server and applies them locally. The ldap_sudo_search_base option defines where in the directory tree SSSD looks for those objects.

When administrators leave ldap_sudo_search_base unset, SSSD falls back to the default LDAP base and searches the entire directory tree. Any sudoRole object it discovers, regardless of location, becomes an authoritative sudo rule on the enrolled host. This behavior collapses the trust boundary of the directory to any location where a user can create objects.

An attacker with write access to a seemingly unrelated subtree, such as a personal or departmental container, can create a sudoRole entry that assigns ALL commands with the root runas user to their own account. Every SSSD client that queries the directory then honors that rule.

Root Cause

The root cause is an insecure default configuration [CWE-1188]. SSSD's sudo provider does not require an explicit, narrowly scoped search base. Absent that constraint, the provider trusts sudoRole objects placed anywhere in the directory. The design assumes that only authorized administrators can create such objects, an assumption that fails whenever LDAP write permissions are delegated at the subtree level.

Attack Vector

Exploitation requires authenticated LDAP write access to any subtree that SSSD's default search will traverse. The attacker creates a sudoRole object specifying their username, target hosts, and permitted commands. On the next sudo rule refresh, every SSSD-enrolled host imports the malicious rule. The attacker then invokes sudo on any affected host and executes commands as root. No user interaction is required, and the attack occurs over the network path already used for directory replication.

No public exploit code is currently referenced in the advisory. Consult the Red Hat CVE-2026-14474 Advisory and Red Hat Bug Report #2496556 for further technical detail.

Detection Methods for CVE-2026-14474

Indicators of Compromise

Unexpected sudoRole objects located outside the intended sudoers organizational unit in LDAP
sudoRole entries whose sudoUser, sudoHost, or sudoCommand attributes grant broad or ALL privileges
Sudo sessions on SSSD-enrolled hosts invoked by accounts that were not previously authorized for privileged access
SSSD cache entries in /var/lib/sss/db/ referencing sudo rules from unfamiliar directory locations

Detection Strategies

Enumerate every sudoRole object in the directory and compare against an approved allowlist tied to a specific organizational unit
Audit LDAP ACLs to identify subtrees where non-administrative users hold write permissions and cross-reference for sudoRole creation events
Parse /var/log/sssd/sssd_sudo.log and sudo auth logs for rules resolved from search bases outside the expected container
Alert on creation or modification of any object with objectClass: sudoRole from directory audit logs

Monitoring Recommendations

Forward LDAP directory audit logs and Linux sudo events to a centralized analytics platform for correlation
Baseline the set of accounts that legitimately execute sudo on each host and alert on deviations
Monitor SSSD sudo refresh intervals and flag rule counts that increase unexpectedly

How to Mitigate CVE-2026-14474

Immediate Actions Required

Set ldap_sudo_search_base explicitly in /etc/sssd/sssd.conf on every enrolled host to a container reserved for sudo rules
Review the LDAP directory for any sudoRole objects outside the sanctioned container and remove unauthorized entries
Restrict LDAP write permissions so that only directory administrators can create or modify sudoRole objects
Rotate credentials for any account observed creating unexpected sudoRole entries

Patch Information

Refer to the Red Hat CVE-2026-14474 Advisory for vendor updates and package availability. Apply distribution-provided SSSD updates as they are released and validate configuration hardening in parallel, since the flaw is rooted in default behavior rather than a code path alone.

Workarounds

Configure ldap_sudo_search_base with a narrow distinguished name such as ou=SUDOers,dc=example,dc=com and deploy the change through configuration management
Apply LDAP access control lists that permit sudoRole object creation only under the designated sudoers container
Disable the SSSD sudo provider by setting sudo_provider = none on hosts that do not require LDAP-sourced sudo rules

bash

# /etc/sssd/sssd.conf hardening example
[domain/example.com]
id_provider = ldap
sudo_provider = ldap
ldap_uri = ldaps://ldap.example.com
ldap_search_base = dc=example,dc=com
ldap_sudo_search_base = ou=SUDOers,dc=example,dc=com
ldap_sudo_smart_refresh_interval = 900
ldap_sudo_full_refresh_interval = 3600